-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Practical Threat Detection Engineering
By :

This section contains two examples demonstrating how we can use OSINT from different types of sources to develop a detection. The first will take a blog post published by a reputable vendor and turn the free-from text into detection criteria. The second example walks through leveraging VirusTotal, an online sandbox, to take a static indicator and obtain contextual information for more robust detection.
In this example, we will take a blog post about an attack campaign and see how we can use it to develop a detection. We performed an exercise in Chapter 6 similar to this but focused on indicators. Now, we are going to look at all levels of the Pyramid of Pain in an attempt to create more robust detections. For this exercise, we will use a report from Trend Micro about a threat actor delivering a backdoor via a watering hole attack: https://www...