Lesson 5 of 10
Threat Intelligence & Hunting
TI
- MISP, OTX, VirusTotal
- IoC vs IoA
- Hunting hypothesis:
hypothesis: PowerShell spawning Rundll32 - Query:
index=sysmon EventCode=1 Image="*powershell.exe" ParentImage="*outlook.exe"
Lesson 5 of 10
hypothesis: PowerShell spawning Rundll32index=sysmon EventCode=1 Image="*powershell.exe" ParentImage="*outlook.exe"