Python for Threat Intelligence
summary
Describes concrete results: analysts at mandiant build Python tools to collect and model hundreds of investigations into a graph, automatically create nodes and edges, parse PE files and X509 certs, and publish detections that find related malware. Tooling includes argparse for CLIs, httpx with event hooks for authenticated API calls, pefile plus asn1crypto for certificate extraction, and yara-python to generate and run detections; outputs use Rich for readable logs and succeeded in speeding analysis.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:59Threat Intelligence
- 5:33Data Modeling & Analysis
- 8:56Applying Python
- 10:15argparse
- 11:30logging
- 12:08rich
- 13:41httpx
- 15:09Model Or It Didn't Happen
- 16:35Modeling Network Scan Data
- 17:35Inspecting Files
- 19:01Generating Detections
- 20:32Engineering without Engineers
related talks
22mMalware Hunting - Using python as an attack weapon
30mPython Platforms for Cyber Security
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
28m"Cyber Security Investigations with Jupyter Notebooks"
29mHow to Spy with Python
27mHow to Improve Your Threat Intelligence Process with AIL Project
30mPySecure: Your Security One Stop Shop using Python