Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo...

30
Cyberwar & Splunk Demonstration Sam Bowne

Transcript of Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo...

Page 1: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Cyberwar & Splunk Demonstration

Sam Bowne

Page 2: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Twitter

Page 3: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 4: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 5: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

• https://www.rfa.org/english/news/china/hacking-02222013121848.html

Page 6: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Kill Chain

Page 7: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 8: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

https://www.businessinsider.com/fbi-aristedes-mahairas-these-4-nations-pose-biggest-cyber-risk-to-us-2018-6

Page 9: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

• https://graquantum.com/a-brief-history-of-cyberwarfare/

A Brief History of Cyberwarfare

Page 10: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Scorecard

• https://warontherocks.com/2017/07/cyber-attacks-whos-keeping-score/

Page 11: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Scorecard

• https://warontherocks.com/2017/07/cyber-attacks-whos-keeping-score/

Page 12: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Chinese Attacks

https://www.belfercenter.org

Page 13: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 14: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Russian Cyberattacks

Page 15: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Iranian Attacks

https://www.recordedfuture.com

Page 16: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 17: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 18: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 19: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Russian Attacks

2006: Litvineko poisioned in London with Polonium-210

2007: Cyberattack on Estonia

2008: Invasion of Georgia

2016: Cyberattacks to influence US election

2018: Skripal poisioned with Novichok nerve agent in Salisbury, England

Page 20: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 21: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 22: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 23: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

US Attack Tools

Page 24: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/

Page 25: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic9-final/report.pdf

Page 26: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 27: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 28: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 29: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 30: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

U.S. Organizations are Losing the Cyberwar

U.S. Organizations are Losing the Cyberwar

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Cyberwar Spotlight: North Korea

Cyberwar Spotlight: North Korea

Cyberwar, International Politics, and Institutional Design

Cyberwar, International Politics, and Institutional Design

Deploying Splunk. Arquitetura e dimensionamento do Splunk

Deploying Splunk. Arquitetura e dimensionamento do Splunk

Splunk conf2014 - Splunk for Data Science

Splunk conf2014 - Splunk for Data Science

20121119 Cybercrime : a basis for cyberwar ?

20121119 Cybercrime : a basis for cyberwar ?

Splunk のご紹介 - hitachi.co.jp · Splunkの歴史. 5 . 2006 . Splunk 1 . Splunk 2 . 2007 . Splunk 3 . 2009 . Splunk 4 . 2010 . Splunk 4.1 . 2011 Splunk 4.2 . App for Enterprise

Splunk のご紹介 - hitachi.co.jp · Splunkの歴史. 5 . 2006 . Splunk 1 . Splunk 2 . 2007 . Splunk 3 . 2009 . Splunk 4 . 2010 . Splunk 4.1 . 2011 Splunk 4.2 . App for Enterprise

China Cyberwar

China Cyberwar

Cyberwar and Weapons of Mass Corruption

Cyberwar and Weapons of Mass Corruption

There WIll Be Cyberwar

There WIll Be Cyberwar

The Myth of CyberWar - Marcus Ranum

The Myth of CyberWar - Marcus Ranum

Night Dragon: Cyberwar Meets Corporate Espionage

Night Dragon: Cyberwar Meets Corporate Espionage

CyberWar para todos

CyberWar para todos

Cyberwar cube

Cyberwar cube

cyberwar strategy

cyberwar strategy

Cyberwar Update2010

Cyberwar Update2010