Threat Hunting//
Threat Hunting Case Study: FileFix
FileFix bypasses Mark of the Web (MotW) protections by hijacking the Windows File Explorer address bar. Here is how to hunt for it.
Structuring a cyber threat intelligence (CTI) program differs for every organization depending on size, the assets it is trying to protect and the threat landscape affecting their particular industry. Kobe Shwartz is the Head of Cyber Threat Intelligence and Analysis at Signify and is also the founder of a consultancy, Underdark.ai (http://underdark.ai/). He was formerly a Russian cybercrime and espionage analyst. In this Studio 471, Shwartz discusses how he started the CTI team at Signify, which was formerly known as Philips Lighting. He also discusses how to manage alert overload, the importance of “Dark Web” intelligence and how to measure return on investment in a CTI program.
Participants:
Kobe Shwartz, Head, Cyber Threat Intelligence and Analysis, Signify
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
