The Best Defense is a Great Offense: Leveraging Automated...
summary
Claim: treat network telemetry as the primary detection source and validate detectors by generating real attacker traffic. Built an automated, ephemeral cloud C2 test harness using Sliver and infrastructure-as-code (terraform/terragrunt) that drives real implants through perimeter sensors ingesting Zeek logs. Early wins include catching DNS TXT exfiltration from a covert red team and a tuned SSL beaconing query that goes from 68 to 8 daily results by combining periodic beaconing, sudden spike, and low-prevalence heuristics. System finds silent pipeline bugs and enables continuous, repeatable validation.
AI-written summary · about
chapters (8)
- 0:00Introduction and team overview
- 1:46EDR limitations and challenges
- 7:03Network telemetry advantages
- 11:36Encryption and detection value
- 16:30Testing detections with purple teaming
- 22:27Detection tuning with real data
- 29:04Key takeaways and automation benefits
- 30:14Q&A on automation and machine learning
related talks
29mDetection Engineering: Defending Networks with Purpose
36mBeing A Better Defender By Channeling Your Worst Adversary:
37mAutomation Tactics for Modern Threat Emulation
12mMulti-Layer Defense for Scalable Threat Mitigation
34mPurple Team Strategies for Application Security
34mA Blueprint for Detection Engineering: Tools, Processes, and Metrics
30mBuilding Effective Attack Detection in the Cloud
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud