ON DEMAND WEBCAST
How to find exfiltration with Zeek and MITRE ATT&CK™
You will discover how to:
- Find instances of encrypted exfiltration by analyzing producer/consumer ratios
- Spot data exfiltration over non-standard protocols like FTP, SMTP, HTTP/S, and DNS
- Monitor for scheduled transfers of exfiltrated data
- And more....
Speakers
Vince Stoffer
Vince Stoffer is Field CTO at Corelight and previously held security engineering and network management positions at Lawrence Berkeley National Laboratory and before that served as a network security engineer at Reed College. Vince holds the CISSP, GCIH and GCIA certifications.
Mark Overholser
Mark Overholser is a Security Engineer at Corelight where he helps organizations capture, interpret, and connect network security data. Mark brings more than twelve years experience in security, system administration, and infrastructure. Prior to Corelight, Mark was a Systems Engineer Specialist at Palo Alto Networks, a Consulting Engineer at LightCyber, and Information Security Team Lead at Medline Industries.