Been an Ent Architect for 25+ yrs and that’s the best clearest, most concise explanation of determining how best to find hidden processes on computers. Thanks.
As a new soc analyst, I found this video very valuable! I got so much insight in such a short amount of time as well as how you should investigate and look into activities. Thanks a ton!
I'm trying to get a job as a SOC Analyst Tier 1. I was told that Exabeam was used in addition to Splunk. I am grateful for these videos as they really give a good demonstration and let the viewer see how this works. The dashboard looks great and user friendly, and the ability to move from the dashboard to investigating the alert is a nice thing to see.
This was an amazing video! I recently got a job as a IR team member after a few years of being a network analyst. Although I have the foundations, I am very new to the job itself so this type of video helps me so much! I will definitely be subscribing!
@@wilfredoperez1804 I've been in the field about 10 years total now if you include education. I currently only have my CompTIA Sec+ and Net+ but for some reason HR departments love those. I don't think they're worth all that much personally, but the amount of offers I got after getting my Sec+ was crazy. I also would recommend looking into the GIAC certifications if you are getting serious about this sort of stuff! I hope you are able to make it into the field easily!
Sorry to be so offtopic but does anyone know of a tool to log back into an instagram account..? I stupidly forgot my password. I appreciate any help you can give me.
@Nasir Kyng thanks so much for your reply. I got to the site thru google and Im in the hacking process now. Seems to take quite some time so I will reply here later with my results.
Thanks for the great behind the scenes look into SIEM monitoring. It's sad that I have a degree from a technical college, and there were hardly any labs, just all theory. I naturally have an investigative mindset so this really intrigues me and I would love to get back into training. Keatron, where does one start?
Hi, thanks for the video. Although you mentioned it, using the md5 command is a lot better and quicker as it gives you the instant hash which you can copy and paste into VT.
Great vid m8! If I may make 2 suggestions (you might already know...): if you first do the RAM memdump be4 using netstat and so on, you wont throw something out of the RAM because you just used two programs. Second, you can also upload a hash of the rootkit to VirusTotal and not the file itself, so not to alert anyone... All in all a great and informative video! Keep up the good work!
Doing a memdump required putting something external on the machine, running netstat did not. The memory dump is far more disruptive than running netstat which is local. Thanks for watching!
You have an alert suggesting there may be an issue, but it was not clear that something was definitively wrong. This is the investigative process for the INV team. Once you know it is a true positive and worthy of time for containment and analysis by a dedicated team (impact to organization) it is then transferred to IR. At least in my experience. This is a good rundown of a tier 2 INV investigation.
Hello. Why we did not see that connections/processes on a victim's machine? Was the rootkit hiding that and only having a dump outside of the victims' machine made the rootkit not interfere the proper outcome of connection/processes?
Wanted to check on SOC. Can there be an IT SOC and an OT SOC. Is it right to say so. Or is it just one SOC and have a SIEM separately for IT and OT. In one of our groups we had this endless debate about SOC, each side backed with their own experience and opinions. What do you think is the right approach, any document/whitepaper you can share that you know of.
Trying to get into SOC T1. What if instead of uploading the rootkit executable on VirusTotal, you instead extracted its hash and compared it to the virustotal database? Wouldn't that be safer?
SuperCybex can provide a cyber defense services for businesses with 50-5000 employees throughout the US to help identify cyber threats and mitigate the risks. Whether your business needs firewalls, network upgrades, or cyber defense and training, we can provide a complete solution including Incident Response
Thanks for sharing, it’s really interesting. I don’t know much about IT, but isn’t it risky to use any automated system to flag up problems? Such system is only as good as its algorithms and the way the administrator configures it. Re the incident. Maybe this lady works remotely from Ukraine? Last but not least, shouldn’t the company’s IT admin check her activity? Please, tell me that Admins can do that despite the employees using VPN, otherwise the system would be safe-ish from external attacks but totally vulnerable to internal attacks. Thanks.
I mean it's tough in an enterprise environment, but I guess anything is possible. The question is, can you do EFFECTIVE incident response without a SIEM in an enterprise environment.
@@KeatronEvans good point. I mentioned SIEM to a manager recently but our discussion came to the fact that the team didn't have anyone to constantly monitor the system and then act/report on anomalies.
memory dump is got from windows machine and if u notice that the windows machine doesn't shown the evil process while seeing through command prompt. But the process is running , so we get information about the evil process running by dumping the memory using tool. and we analyze the memory dump file in kali
why wouldn't u just ask her if she VPN'ed from Ukraine? ":hi, yea were u in ukraine yesterday? no? did u have a VPN on that was pointing to Ukraine? no?" hmmm
![[#2024MAMA] ROSÉ (로제), Bruno Mars - APT. | Mnet 241122 방송](http://i.ytimg.com/vi/dgGqD28J6aQ/mqdefault.jpg)
Been an Ent Architect for 25+ yrs and that’s the best clearest, most concise explanation of determining how best to find hidden processes on computers. Thanks.
Thank you for watching!
As a new soc analyst, I found this video very valuable! I got so much insight in such a short amount of time as well as how you should investigate and look into activities. Thanks a ton!
I felt this 12 minutes like 5 minutes. That's when you can tell it's a good video. Entertaining, informative and educational.
Thanks for watching!
ّ
😊چ
ۃ
ۃچ
ےچج
ّچجچچچ
ځ،
چ
ځ
ّچ
ّ
ّ
ّ
ّجک
ځ
ّ،کجکج
Ooo
Finally, a real look into the trenches of SOC and IR.
Please keep up a good work!
Thank you for watching!
This is great. It is rare to find such a good walkthrough on this stuff. Thanks!
I'm trying to get a job as a SOC Analyst Tier 1. I was told that Exabeam was used in addition to Splunk. I am grateful for these videos as they really give a good demonstration and let the viewer see how this works. The dashboard looks great and user friendly, and the ability to move from the dashboard to investigating the alert is a nice thing to see.
This was an amazing video! I recently got a job as a IR team member after a few years of being a network analyst. Although I have the foundations, I am very new to the job itself so this type of video helps me so much! I will definitely be subscribing!
How long have you been doing IT? Do you recommend any certs?
We're so glad you found it useful!
@@wilfredoperez1804 I've been in the field about 10 years total now if you include education. I currently only have my CompTIA Sec+ and Net+ but for some reason HR departments love those. I don't think they're worth all that much personally, but the amount of offers I got after getting my Sec+ was crazy. I also would recommend looking into the GIAC certifications if you are getting serious about this sort of stuff! I hope you are able to make it into the field easily!
Could you please give me your contact number, am also trying to soc analyst
Dang Keatron you break it down like this was a sermon !! This is awesome
Why does this only have 1.5k views?
Great walkthrough sir.
Trending upward!
It has 20k views now.
Sorry to be so offtopic but does anyone know of a tool to log back into an instagram account..?
I stupidly forgot my password. I appreciate any help you can give me.
@Khari Kyle Instablaster =)
@Nasir Kyng thanks so much for your reply. I got to the site thru google and Im in the hacking process now.
Seems to take quite some time so I will reply here later with my results.
Thanks for the great behind the scenes look into SIEM monitoring. It's sad that I have a degree from a technical college, and there were hardly any labs, just all theory. I naturally have an investigative mindset so this really intrigues me and I would love to get back into training. Keatron, where does one start?
Thank you for sharing. I have been trying to get an entry-level job as a SOC, and 😐it's an exciting role.
I’m only 4:18 in and I must say this is an excellent video.
This was excellent: short, informative, and clear. Thank you!
Good content! I look forward to part 2.
Exactly the kind of content I needed!! Thanks a billion
Thank you for watching!
Whew would recommend this video to anyone! Thank you for a value add!
Hi, thanks for the video. Although you mentioned it, using the md5 command is a lot better and quicker as it gives you the instant hash which you can copy and paste into VT.
Thank you!
This was very educative .
Thank you!
A+ material. i will be ready for my upcoming table top exercise. Thanks a bundle!
Thank you!
Great vid m8!
If I may make 2 suggestions (you might already know...): if you first do the RAM memdump be4 using netstat and so on, you wont throw something out of the RAM because you just used two programs. Second, you can also upload a hash of the rootkit to VirusTotal and not the file itself, so not to alert anyone...
All in all a great and informative video! Keep up the good work!
Doing a memdump required putting something external on the machine, running netstat did not. The memory dump is far more disruptive than running netstat which is local. Thanks for watching!
This is the content I’m looking for earned subscriber 🎉
what should be the design or architecture of a SOC Center? Please provide and assist my new SOC Center.
Great video
You have an alert suggesting there may be an issue, but it was not clear that something was definitively wrong. This is the investigative process for the INV team. Once you know it is a true positive and worthy of time for containment and analysis by a dedicated team (impact to organization) it is then transferred to IR. At least in my experience. This is a good rundown of a tier 2 INV investigation.
great job, esp.2prep 4 interviews this was handy, keep it comin, youll get 1m subs
just getting in and this was fun to watch
Thank you!
Thanks for watching!
Hi, if you don't use virustotal to identify malware, what commercial tool do you use? Also, please make more videos. I will support the channel!
Wow this was so informative. I really needed it, same question bothered me, how do you know when to dig deeper into an alert. Thanks
Thank you!
Great video but i tried to download the exabeam but cant. do i have to pay for full download?
Great video!!
Thanks!
It’s a good video. Thank you for giving us a light on this matter.
Thank you for watching!
Please I have a question. Is security+ course okay for new Comer into cyber security
Sir your videos are great . I am looking for trial version to update my skills . Do you offer free trial version?
Thank you so much for this insightful video.
Thank you for watching!
Absolutely fantastic info
Thank you!
Thanks Keatron! Subbed to YOUR channel!
Great video! Thank you!
Thank you!
thanks a lot for valuable video please keep doing such a videos very informative. thanks again.
awesome video. thanks for the detailed explanation
Thank you for watching!
Great demonstration, thank you!
Thank you!
This was an awesome video
Thank you!
Thank you
Excellent 👍🏾
Amazing video. Thanks so much
Thank you for watching!
That was a great video. I learned a lot. Thank you so much for posting this.
Thank you!
Hello. Why we did not see that connections/processes on a victim's machine? Was the rootkit hiding that and only having a dump outside of the victims' machine made the rootkit not interfere the proper outcome of connection/processes?
Yes, the rootkit was not allowing Windows to "show" you the connections.
I wasn't aware Victor Wooten was into cyber security!
Awesome comment! I've been playing since I was a kid.
Wanted to check on SOC. Can there be an IT SOC and an OT SOC. Is it right to say so. Or is it just one SOC and have a SIEM separately for IT and OT.
In one of our groups we had this endless debate about SOC, each side backed with their own experience and opinions. What do you think is the right approach, any document/whitepaper you can share that you know of.
great video!
Thanks!
Thanks. Very useful.
Thank you!
Just super cool. This is why its so fun
Really great. I appreciate honestly
Thank you!
Thank you for the video.
this is a good staff, How to do it on kubernetes?
Is this open source? I would like to practice
Wow this was so helpful
Is RSA security analytics siem tool good?
Outstanding!!!!
You're outstanding! Thank you!
Awesome Stuff!
Trying to get into SOC T1. What if instead of uploading the rootkit executable on VirusTotal, you instead extracted its hash and compared it to the virustotal database? Wouldn't that be safer?
really useful, thanks bro
Thank you!
It looks simple. not too much coding. Finally i have a dreamjob i'm dreaming about.
Great video thank you
fanstatic video please make more video tutorials.
Will do, thanks!
This looks difficult to do all of these steps, what type of position do this type of work
It's not difficult, just takes practice.
Hey I know this guy!! Lol
thank you!
ITS REALLY WORKED LOL THANK YOU DUDE
Thanks man
Thank you %100 works
SuperCybex can provide a cyber defense services for businesses with 50-5000 employees throughout the US to help identify cyber threats and mitigate the risks. Whether your business needs firewalls, network upgrades, or cyber defense and training, we can provide a complete solution including Incident Response
what is the software used @ 7.50 ?
Can you make more videos like this please
3:45 How do you know info about somebody’s behaviour if they use a VPN?
dude tNice tutorials is super good! subbed
GENIUS
Thanks sir
Thank you!
Thanks for sharing, it’s really interesting.
I don’t know much about IT, but isn’t it risky to use any automated system to flag up problems? Such system is only as good as its algorithms and the way the administrator configures it.
Re the incident. Maybe this lady works remotely from Ukraine?
Last but not least, shouldn’t the company’s IT admin check her activity? Please, tell me that Admins can do that despite the employees using VPN, otherwise the system would be safe-ish from external attacks but totally vulnerable to internal attacks.
Thanks.
How to resolve this one?
You gonna jam on that bass or not?
Incident response without a SIEM - is it even possible?
I mean it's tough in an enterprise environment, but I guess anything is possible. The question is, can you do EFFECTIVE incident response without a SIEM in an enterprise environment.
@@KeatronEvans good point. I mentioned SIEM to a manager recently but our discussion came to the fact that the team didn't have anyone to constantly monitor the system and then act/report on anomalies.
Watching this in 2023 and seeing 3:55 is wild 😭
Is that windows XP?
I didn't understand where and why did you got the memory dump?
How did he get into victim device
memory dump is got from windows machine and if u notice that the windows machine doesn't shown the evil process while seeing through command prompt. But the process is running , so we get information about the evil process running by dumping the memory using tool. and we analyze the memory dump file in kali
That damn Barbara!
❤❤❤❤
Didnt work for me
👆👆👆👆👆HE SAVE MY FILE AND DECRYPT IT.HE’S THE BEST HACKER IN THE WORLD !!!
is that windows 7 :o
Like
why wouldn't u just ask her if she VPN'ed from Ukraine? ":hi, yea were u in ukraine yesterday? no? did u have a VPN on that was pointing to Ukraine? no?" hmmm
+
It's always the HR lady :(
It's Ukraine, not the Ukraine.
Great video!!