Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo...

30
Cyberwar & Splunk Demonstration Sam Bowne

Transcript of Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo...

Page 1: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Cyberwar & Splunk Demonstration

Sam Bowne

Page 2: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Twitter

Page 3: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 4: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 5: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

• https://www.rfa.org/english/news/china/hacking-02222013121848.html

Page 6: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Kill Chain

Page 7: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 8: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

https://www.businessinsider.com/fbi-aristedes-mahairas-these-4-nations-pose-biggest-cyber-risk-to-us-2018-6

Page 9: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

• https://graquantum.com/a-brief-history-of-cyberwarfare/

A Brief History of Cyberwarfare

Page 10: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Scorecard

• https://warontherocks.com/2017/07/cyber-attacks-whos-keeping-score/

Page 11: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Scorecard

• https://warontherocks.com/2017/07/cyber-attacks-whos-keeping-score/

Page 12: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Chinese Attacks

https://www.belfercenter.org

Page 13: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 14: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Russian Cyberattacks

Page 15: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Iranian Attacks

https://www.recordedfuture.com

Page 16: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 17: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 18: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 19: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Russian Attacks

2006: Litvineko poisioned in London with Polonium-210

2007: Cyberattack on Estonia

2008: Invasion of Georgia

2016: Cyberattacks to influence US election

2018: Skripal poisioned with Novichok nerve agent in Salisbury, England

Page 20: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 21: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 22: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 23: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

US Attack Tools

Page 24: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/

Page 25: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic9-final/report.pdf

Page 26: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 27: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 28: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 29: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific
Page 30: Cyberwar & Splunk Demonstrationsplunk> CORE CERTIFIED USER e 6) a https// samsclass. nfo 150/oroi/ourale-bots.htm Purple Team 4: Threat Hunting with Splunk (325 pts) Scores from Pacific

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Cyberwar Spotlight: Iran

Cyberwar Spotlight: Iran

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk user group - automating Splunk with Ansible

Splunk user group - automating Splunk with Ansible

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Cyberwar cube

Cyberwar cube

Smau Milano 2011 Gentili-Fratpietro cyberwar

Smau Milano 2011 Gentili-Fratpietro cyberwar

Splunk Conf2010: Corporate Express presents Splunk with SAP

Splunk Conf2010: Corporate Express presents Splunk with SAP

In defense of cyberwar

In defense of cyberwar

U.S. Organizations are Losing the Cyberwar

U.S. Organizations are Losing the Cyberwar

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

Cyberwar: Clausewitzian Encounters - Professorprofessor.ufrgs.br/marcocepik/files/cepik__canabarro...Article Cyberwar: Clausewitzian Encounters Marco Cepik, Diego Rafael Canabarro,

Cyberwar: Clausewitzian Encounters - Professorprofessor.ufrgs.br/marcocepik/files/cepik__canabarro...Article Cyberwar: Clausewitzian Encounters Marco Cepik, Diego Rafael Canabarro,

The Myth of CyberWar - Marcus Ranum

The Myth of CyberWar - Marcus Ranum

COE-OROI RIKEN KEIKI PORTABLE SINGLE GAS MONITOR MODEL …

COE-OROI RIKEN KEIKI PORTABLE SINGLE GAS MONITOR MODEL …

Splunk Enterprise 6.5.0 Splunk Enterprise 보안

Splunk Enterprise 6.5.0 Splunk Enterprise 보안

Cyberwar - Ainda podemos proteger nossos dados?

Cyberwar - Ainda podemos proteger nossos dados?

Night Dragon: Cyberwar Meets Corporate Espionage

Night Dragon: Cyberwar Meets Corporate Espionage

Cyberwar - Is India Ready

Cyberwar - Is India Ready

La issa-2015-cyberwar-ranum

La issa-2015-cyberwar-ranum

CyberWar para todos

CyberWar para todos