The Art of Threat Detection Engineering
DISCARDED: Tales From the Threat Research Trenches
00:00
How to Create Signatures on an Attack Chain?
There are so many steps in the attack chan before it actually gets to the sort of malicious payload. So how then, do you create signatures on an attack chain? Like, you sai doesn't have a malicious component until the payload is actually dropped on a host. But typically antivarus vendos are using, or like theres also plemevia an open source antivarus vendo softer or charer rules which are also static. And we can build up so called state machines, which check on the concatenation of certain events that happened in those in the sent box.
Transcript
Play full episode
