Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
The Most Dangerous Game
Search
Scott J. Roberts
February 03, 2015
Technology
5
5.2k
The Most Dangerous Game
A presentation about merging Threat Intelligence and DFIR by the team behind YoloThre.at.
Scott J. Roberts
February 03, 2015
Tweet
Share
More Decks by Scott J. Roberts
See All by Scott J. Roberts
Tortured Responders Dept - Scott & Rebekah's Edition
sroberts
0
96
Skynet the CTI Intern: Building Effective Machine Augmented Intelligence
sroberts
0
76
DRIVING INTELLIGENCE WITH MITRE ATT&CK: LEVERAGING LIMITED RESOURCES TO BUILD AN EVOLVING THREAT REPOSITORY
sroberts
0
44
Exploring Threat Intelligence: Insights and Tools from Vertex Synapse
sroberts
0
24
Homemade Ramen & Threat Intelligence
sroberts
2
510
Introduction to Open Source Security Tools
sroberts
3
4.8k
Building Effective Threat Intelligence Sharing
sroberts
1
120
Japanese Manufacturing, Killer Robots, & Effective Incident Handling
sroberts
0
110
Crisis Communication for Incident Response
sroberts
1
330
Other Decks in Technology
See All in Technology
「隙間家具OSS」に至る道/Fujiwara Tech Conference 2025
fujiwara3
6
6.3k
JuliaTokaiとJuliaLangJaの紹介 for NGK2025S
antimon2
1
110
あなたの知らないクラフトビールの世界
miura55
0
120
デジタルアイデンティティ人材育成推進ワーキンググループ 翻訳サブワーキンググループ 活動報告 / 20250114-OIDF-J-EduWG-TranslationSWG
oidfj
0
440
エンジニアリングマネージャー視点での、自律的なスケーリングを実現するFASTという選択肢 / RSGT2025
yoshikiiida
4
3.6k
Reactフレームワークプロダクトを モバイルアプリにして、もっと便利に。 ユーザに価値を届けよう。/React Framework with Capacitor
rdlabo
0
110
【NGK2025S】動物園(PINTO_model_zoo)に遊びに行こう
kazuhitotakahashi
0
210
駆け出しリーダーとしての第一歩〜開発チームとの新しい関わり方〜 / Beginning Journey as Team Leader
kaonavi
0
120
20250116_JAWS_Osaka
takuyay0ne
2
200
Amazon Q Developerで.NET Frameworkプロジェクトをモダナイズしてみた
kenichirokimura
1
190
カップ麺の待ち時間(3分)でわかるPartyRockアップデート
ryutakondo
0
130
.NET 最新アップデート ~ AI とクラウド時代のアプリモダナイゼーション
chack411
0
190
Featured
See All Featured
Faster Mobile Websites
deanohume
305
30k
The Pragmatic Product Professional
lauravandoore
32
6.4k
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
panda_program
98
18k
Automating Front-end Workflow
addyosmani
1366
200k
Facilitating Awesome Meetings
lara
51
6.2k
Bash Introduction
62gerente
610
210k
Building Flexible Design Systems
yeseniaperezcruz
328
38k
The MySQL Ecosystem @ GitHub 2015
samlambert
250
12k
4 Signs Your Business is Dying
shpigford
182
22k
Building Your Own Lightsaber
phodgson
104
6.2k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
danielanewman
226
22k
The World Runs on Bad Software
bkeepers
PRO
66
11k
Transcript
The Most Dangerous Game Hunting Adversaries Across the Internet
Kyle Maxwell Super Special Security Researcher @ iDefense
Scott J Roberts Advanced Persistent Incident Responder @ GitHub
How Kyle met Scott or How Scott met Kyle
If you are on the Twitter we’re @kylemaxwell & @sroberts
#YOLOTHREAT
Intelligence Concepts That everyone knows and already agrees on right…?
Data vs Intelligence Intelligence has gone through the intelligence process
Data is a raw piece of information without context
Feedback Analysis Processing Dissemination Collection Requirements Intelligence Cycle
F3EAD While… Find Exploit Finish Disseminate Fix Analyze
The Target
What is Targeting? Making a plan for focusing threat research
& investigation
Targeting Methodologies Actor Centric ~ Target Centric ~ Technology centric
Feeds Needles in Haystacks
“My 5.4 gazillion indicators can beat up your threat indicators.
Garbage in garbage out #ThreatIntel ~ Rick Holland
Honeypots Bringing the Bad Guys to You
Low vs High Interaction High interaction honeypots are a risky
& complicated way to generate high quality intelligence Low interaction honeypots are an easy way to get low value intel on commodity threats
Software Old School: HoneyNet Project New Hotness: Modern Honey Network
by Threat Stream
Vulnerability Information Taking care of your Toys
“Structured vulnerability analysis is not threat intelligence it is requirements
gathering for threat intelligence. ~ @selil
Vendor Information Blogs ~ Reports ~ Services & APIs
Personal Aside to Vendors If you’re going to release a
report, blog post, etc: do not break the Cut and Copy Actions
None
Review Your Own Incidents Mine that fancy Incident Management System…
Review Your Others Incidents By sharing or News mining
The Hunt
What to Analyze Technical Sources
What to Analyze: Hashes Reversing: • C2 info • Developer
artifacts Sources: • VxShare • VirusTotal • malwr.com
What to Analyze: Passive DNS • Single most useful tool
for infrastructure research • What resolved to what, and when? • DNSDB (Farsight), PassiveTotal, VirusTotal
What to Analyze: Whois • Tougher to Acquire • WhoDat
etc for ongoing Tracking
What to Analyze Actors
What to Analyze: Criminal • Primary Weapon: Google • Social
Media (Twitter, Facebook) • Underground forums?
What to Analyze: Espionage • This is hard • Malware
& System artifacts • whois/registrar data • actions over target
How to Keep Tracking
Threat Library • CRITs is popular, MISP also • Lighter
solutions often work • Market hasn't fully addressed this
Web Monitoring Systems • Netflix Scumblr Meta SearcH (Works alongside
Sketchy) • Recorded Future • Lots of custom development
Malware Monitoring • VirusTotal is • Malware feeds with Lots
of custom internal solutions • Maltrieve, Viper, & Cuckoo
Internal Logging • Firewall, IDS, & Proxy • Web, mail,
& DNS • Authentication & Audit
The “Kill”
Incident Response The Entire Goal… Right?
The Imitation Game Don’t let them know that you know
that they know…
Attribution Probably doesn’t matter unless you can do this
Hand Cuffs or Cruise Missiles
KICK ‘EM OUT NOW! Sometimes it’s better to watch for
a while
Intel Driven Responses deny Deceive ⁉️ degrade ⁉️ disrupt ⁉️
Destroy ‼️
Communication Who can make use of this information? ~ Who
might be able to provide additional intel?
The Hunting Stories
Products IOCs & RFIs ~ Short Form Products ~ Long
Form Products
Audience Internal - Team Internal - Organization External - Peers
External - Wide
IOCs - Generalized Stix & OpenIOC
“you pretty much need a PHD in XML to understand
either STIX or TAXII ~ Jeff Bryner
XKCD.com/927
IOCs - Specialized Yara: Malware centric av signature style IOCs,
getting more advanced Snort: Go to for network activity, Comprehensive and well supported
“OH: "Yara is an antivirus that you update using git
pull" ~ @tomchop_
Requests For Intelligence A Q/A requesting very specific Intelligence ~
Shortest form Possible ~ Fastest turn around
Short Form Products Intermediate products to support incident response ~
Focus on actionable Information
Long Form Products Comprehensive “All Source” intelligence products ~ Requires
considerable Time & a well rounded team
The Surprise…
You Can’t Download a Threat Intelligence Until now….
The Surprise Coming out of Stealth Today, our new Startup…
YOLOTHRE.At
Announcement yolothre.at has run out of runway (We used up
our whole Starbucks Gift Card) SO we’re open sourcing everything and going back to our old jobs...
YoloThre.at A collection of open source docker containers for Threat
Intel
Including Maltrieve Malware Collection Combine Threat Feed Aggregator Scumblr Social
Network Collection CRITs Intel Collection System MISP Malware Analysis Hub ELK Log Analysis Viper Malware Zoo System Thug Website Collection Tool Yara Malware Identification
Review
Review The Target The Hunt The “Kill” The Hunting Stories
Questions?
Thanks
None