Ross Wolf - The Hunter Games: How to find the adversary with EQL
Channel: BSides SATX
Date: 2019-09-22

Title: The Hunter Games: How to find the adversary with EQL 
Presenter: Ross Wolf (@rw_access)
Track: In The Weeds 04
Time: 1300
BSides San Antonio 2019
June 08 at St. Mary's University, San Antonio, Texas

Abstract:
How do you find malicious activity? We often resort to the cliche, “you know it when you see it”, but how do you even “see it”, without drowning in data? MITRE’s ATT&CK organizes adversary behavior and orients our approach to telemetry. With the Event Query Language (EQL), a security analyst can naturally express queries for IOC search, hunting, and behavioral detections, while remaining platform and data source agnostic.
In this talk, I will demonstrate the iterative process of establishing situational awareness, creating targeted detections, and hunting for the adversary in your environment with real data, queries, and results.

Speaker Bio:
Ross Wolf is a researcher at Endgame where he creates solutions to simplify detecting adversarial behavior in endpoint data. Prior to Endgame, Ross was an engineer at MITRE where he led projects that automated blue team processes by creating graphs of process activity and grouping related alerts. He was recently co-granted a patent for CALDERA, a project which automated post-compromise adversary emulation. Ross also contributed to ATT&CK and the Cyber Analytics Repository.