Detecting Lateral Movement in Microsoft Environment with Suricata (Part 2)

The Open Information Security Foundation (OISF) is a team of multi-national software developers and security experts committed to open source security technologies andidentifying groundbreaking trends in information security and network monitoring.OISF,a 501(c)3 non-profit organization,owns and supports Suricata. To learn more about the community or becoming a consortium member contact us atinfo@oisf.net

OISF

In this 3-part webinar series, we aim to take a thorough hands-on approach to show you how to use Suricata's SMB and DCERPC logs.

Suricata is the world-renowned IDS / IPS and NSM engine. It is capable of generating a combined log stream from separate information elements, including network protocol events, alerts, PCAP files (full packet capture), and extracted files as it sniffs live network traffic or sits inline.Suricata produces over 25 different types of log data, including protocol and decoding anomalies, alerts, and many other network transaction protocol events. Each of the events produced by Suricata has its own type. Two of those log types are SMB and DCERPC. These are produced by Suricata based on its native auto protocol parsing and logging capability. As fundamental elements of the Microsoft Windows and Active Directory infrastructure, various versions of the SMB/DCERPC protocols are natively used by enterprises of all sizes. Unfortunately these are often used by threat actors for lateral movement once a breach beachhead has been established in the organization.This is where the Suricata event type SMB and DCERPC logs become very helpful in hunting scenarios.In this 3-part webinar series, we aim to take a thorough hands-on approach to show you how to use Suricata&#x27;s SMB and DCERPC logs for lateral detection. The series covers hunting approaches with pure network transaction data and explains where, how, and when it makes sense to write a signature for a specific use case.Part 2 will concentrate on creating and reviewing some useful visualizations for lateral detection hunting based on the SMB and DCERPC protocol data that Suricata produces. This will be a hands-on review of specific cases.P﻿art 1 can be viewed at: https://www.youtube.com/watch?v=GMapwE6GJZM

Detecting Lateral Movement in Microsoft Environment with Suricata (Part 2)

More events from OISF

Discover more events from OISF, from Science & Tech to other experiences you might love.

Still looking for the right event?

Explore all online events to browse and filter by date, category, and more.

Detecting Lateral Movement in Microsoft Environment with Suricata (Part 2)

More events from OISF

Discover more events from OISF, from Science & Tech to other experiences you might love.

You might also like...

Browse more events with different dates, prices, and formats to find your next great experience.

Still looking for the right event?

Explore all online events to browse and filter by date, category, and more.