Are Beacons Evil? - Bill Stearns & Keith Chew - 1 Hour

Want to level up your threat-hunting knowledge? Take our FREE, hands-on threat hunt training course: https://www.activecountermeasures.com...

Join the Threat Hunter Community   / discord  
00:00 - PreShow Banter™ — Evil Bacon
03:30 - FEATURE PRESENTATION:
04:27 - Threat Types to Consider
12:07 - It’s a Beacon, It MUST Be Evil!
18:02 - Benign Traffic That Look Like Threats
45:12 - What if I Don’t Know?
49:12 - Whitelisting Support
52:04 - References
56:53 - Thanks & Questions

Video Description: We all know that beacons - regular connections between systems - are commonly used to carry instructions and data in a command and control channel. But that raises an interesting question; are Beacons always malicious? In this presentation by Active Countermeasures', Keith Chew, & Bill Stearns, we'll look at the Threat types normally associated with command and control traffic and see how legitimate application traffic can show up.

We'll go over the types of traffic and how to identify and whitelist them.


Active Countermeasures Socials
Twitter:   / activecmeasures  
LinkedIn:   / active-countermeasures  
Discord:   / discord  

Our Threat Hunting Tool ~ AC-Hunter (Formally AI-Hunter)
Features - https://www.activecountermeasures.com...
Interactive Demo Space - https://www.activecountermeasures.com...

Active Countermeasures Open-Source Tools
https://www.activecountermeasures.com...

Educational Threat Hunting Content
FREE 6-Hour Threat Hunt Training: https://www.activecountermeasures.com...
Active Countermeasures Blog: https://www.activecountermeasures.com...
Active Countermeasures YouTube:    / activecountermeasures  

Learn Threat Hunting Skills from Antisyphon Training
Entry-Level (Pay-What-You-Can): https://www.antisyphontraining.com/pa...
Advanced: https://www.antisyphontraining.com/ad...

Active Countermeasures Shirts
https://spearphish-general-store.mysh...

Our Tribe
Black Hills Infosec: https://www.blackhillsinfosec.com/
Wild West Hackin' Fest: https://wildwesthackinfest.com/
Antisyphon Training: https://www.antisyphontraining.com/