Resources
As promised in the video I talk about FP tuning, and really getting to know your telemetry to be able to distinguish if a action is normal or not. The best way to get experience is by getting as much as possible to gain familiarity here are some resources to be able to do so:
- SANS DFIR “Hunt Evil” poster
- EchoTrail
- LOLBAS Project
Ready for more! Get ready for part 6 where we get to begin to start playing with more advanced capabilities using YARA scanning! See you guys in the next one! Remember, to stay legendary!