Trawling for IOCs: Catching C2 in a Sea of Data
summary
Data-driven detection engineering focuses on extracting concrete indicators and turning them into rules and feeds: pivoting a signer name in VirusTotal yields 6,000 hashes for UltraVNC, running SQL pivots across internal telemetry joins those hashes into a development threat feed, using VirusTotal Live Hunt and YARA on sandbox behaviors uncovers GitHub usercontent URLs, and a small Python pipeline with Jinja templates generates many regex-based rules while normalization and escaping workarounds reduce maintenance pain.
AI-written summary · about
chapters (7)
- 0:00Introduction and conference theme
- 3:39Trawling for signer identities
- 9:57Finding GitHub repositories
- 15:15Generating detection rules
- 19:50Regular expression pitfalls
- 21:15Data-driven detection engineering
- 23:45Q&A session
related talks
55mCyber Security vs. Statistics
32mUnlocking Insights: The Role of TI in Modern DFIR Operations
25mAutomating Cyber Threat Intelligence: A Practical Approach to Managing Emerging Vulnerabilities
40mLeveraging Suricata in the Enterprise: Shifting from Events to Insights
47mWorm Charming: Harvesting Malware Lures for Fun and Profit
22mTechnical Tracks
40mHunt and Gather: Developing Effective Threat Hunting Techniques
37mAutomatic Extraction of Indicators of Compromise for Web App.