Breach - ATT&CK - Osquery
summary
Maps SingHealth and NotPetya breach reports to MITRE ATT&CK and shows concrete osquery checks that detect real steps not abstract defenses. Calls out initial workstation compromise, lateral movement over SMB port 445, Citrix/RDP access, credential dumping and persistence, and file encryption. Demonstrates queries for process_open_sockets, parentchild process anomalies, PowerShell script block logging and command length outliers, registry wildcards to audit Office macros, logon_type checks for service accounts, LAPS key validation, honey user detection, and file event monitoring for ransomware.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 2:00How to use Osquery
- 2:18Breach reports
- 4:14Breach example
- 5:55Tactics used
- 8:32Open sockets
- 9:41PowerShell
- 12:04Process Events
- 12:40Windows
- 14:00Windows OS
- 14:10Office hardening
- 15:45String operations
- 16:45Enable unsafe client mail rules
- 18:25Service accounts
- 18:42Logging in as a service
- 19:18Laps
- 19:35Registry Key
- 20:04Weak Password
- 21:15Logon Type
- 21:37Interactive Logon
- 23:08NotPetya
- 24:57Getting started with Osquery
- 26:05Osquery is unbeatable
- 26:25Osquery repo
related talks
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
42mStart Covering Your Bases And Stop Chasing APT Headlines
52mStart covering your bases & Stop chasing APT headlines
42mKeynote: The Expanding Universe of Cyber Threats
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
17mOSINT to Compromise
36mBeing A Better Defender By Channeling Your Worst Adversary: