RITA - Finding Bad Things on Your Network Using Free and Open Source Tools

Join us in the Black Hills InfoSec Discord server here:   / discord   to keep the security conversation going!

Want to get started on a hunt team and discover "bad things" on your network?

In this webcast, we will walk through the installation and usage of Real Intelligence Threat Analytics (RITA). RITA is an open-source framework from the folks at Black Hills Information Security and Offensive CounterMeasures. RITA ingests Bro logs and seeks out malicious payload beaconing and scanning behavior. It also determines which systems in your environment are talking with known bad IP addresses and domains. In less than an hour, you will learn how to collect and analyze network traffic for hunt teaming analysis.

We will also provide some sample Bro logs for you to play with and give RITA a test drive. Want to use your own Bro logs? Great! Just make sure your logs come from an egress pre-NAT point where we can see the internal RFC 1918 IP addresses talking to external IP addresses.

We'll cover the different types of math used in our analysis, including:
Connection intervals
Data sizes
Connection times

As a bonus, our sponsor, LogRhythm, will be showing off a completely free network monitoring tool called Network Monitor Freemium — a free tool for network monitoring, application detection, and detecting suspicious network activity (including lateral movement)!

RITA webpage: https://www.activecountermeasures.com...

Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-...

Black Hills Infosec Socials
Twitter:   / bhinfosecurity  
Mastodon: https://infosec.exchange/@blackhillsi...
LinkedIn:   / antisyphon-training  
Discord:   / discord  

Black Hills Infosec Shirts & Hoodies
https://spearphish-general-store.mysh...

Black Hills Infosec Services
Active SOC: https://www.blackhillsinfosec.com/ser...
Penetration Testing: https://www.blackhillsinfosec.com/ser...
Incident Response: https://www.blackhillsinfosec.com/ser...

Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: https://www.backdoorsandbreaches.com/
Play B&B Online: https://play.backdoorsandbreaches.com/

Antisyphon Training
Pay What You Can: https://www.antisyphontraining.com/pa...
Live Training: https://www.antisyphontraining.com/co...
On Demand Training: https://www.antisyphontraining.com/on...

Educational Infosec Content
Black Hills Infosec Blogs: https://www.blackhillsinfosec.com/blog/
Wild West Hackin' Fest YouTube:    / wildwesthackinfest  
Active Countermeasures YouTube:    / activecountermeasures  
Antisyphon Training YouTube:    / antisyphontraining