SEC1633C | 10:30 AM - 11:15 AM PDT

Rock Em' SOC Em': Arming Security Analysts to Defeat Adversaries by Hunting for Threats with Sigma Rules

Cam Thorpe, Senior Manager, Professional Services - Recorded Future

Justin Grosfelt, Principle Malware Reverse Engineer - Recorded Future

Prior to dropping end-stage malware, threat actors escalate their attack by establishing persistence, escalating privileges or moving laterally. These tools leave log or file-based artifacts, allowing defenders to detect them. This session will demonstrate how to use Sigma rules, Splunk® Enterprise, Splunk® Enterprise Security, and Splunk® SOAR to detect and hunt malware-related activities. We’ll also discuss how our team investigates malware variants, identifies tools and tactics, techniques, and procedures (TTPs), and writes Sigma rules to catch them.

Skill Level: Intermediate

Roles: Security Analyst/Manager, SOC Manager/Director, Threat Researcher/Hunter

Products/Services: Splunk® Enterprise, Splunk® Enterprise Security, Splunk® Security, Orchestration, Automation and Response (SOAR)

Researching thousands of raw data points is often a manual and time-consuming process, but Recorded Future has helped over 1,500 clients to triage alerts faster, detect more threats, and supercharge their Splunk environment. We’ve taken what we’ve learned along the way and compiled it into a bundle of resources–The Intelligence for Splunk Kit–to help you leverage our proprietary data and best practices.

The kit includes:

Report: AWS, Recorded Future, and Splunk: Better Security Operations Together
Video: Operationalizing Threat Intelligence
Video: Expect More From Your Threat Intelligence
Guide: Intelligence Drives Faster, Smarter Decisions
Guide: Security Intelligence Handbook

These resources will help you develop and operationalize an intelligence-led security program, identify false positives, prioritize events, and automate alert response, up-level your security program by connecting your SIEM and SOAR to retro-threat hunt, and more.