Profile cover photo
Profile photo
David Bianco
139 followers
139 followers
About
David Bianco's posts

Post has attachment
Hunting for Malware Critical Process Impersonation
A popular technique for hiding malware running on Windows systems is to give it a name that's confusingly similar to a legitimate Windows process, preferably one that is always present on all systems. The processes that Windows normally starts during boot (...

Post has attachment
Detecting Data Staging & Exfil Using the Producer-Consumer Ratio
In their FloCon 2014 presentation  PCR - A New Flow Metric , Carter Bullard and John Gerth introduced the idea of the Producer-Consumer Ratio (PCR) for measuring and tracking shifts in the typical pattern of network communication for each host. PCR is calcu...

Post has attachment
A Simple Hunting Maturity Model
It's been conference season for me lately. I've attended several in the last few months, and most of them have had at least a few sessions on "hunting".  Since that's a research interest of mine, of course I attended all of them that I could possibly fit in...

Post has attachment
Triage Any Alert With These Five Weird Questions!
(OK, so I went all "BuzzFeed" on the title.  My alternate was going to be "What kind of alert are you?  Take this quiz and find out!" so be thankful.) Introduction There are few things more frustrating to users than using a tool which doesn't support (or ma...

Post has attachment
The Defense Chain
Intro If you're reading my blog, you're probably already familiar with the Kill Chain  (KC).  Briefly, it's a generalized model of the stages an adversary has to go through to carry out a targeted attack.  It's been around for several years now, and just se...

Post has attachment

Post has attachment
Use of the term "Intelligence" at RSA
I attended RSA 2014 this week, and one of the things that struck me was the recurrence of the term "intelligence" on many vendor booths.  I decided it would be a fun exercise to go through the expo halls to ask the vendors to clarify what their uses of the ...

Post has attachment
BSidesAugusta
Update 2014-01-17 Holy wow, I just found this in my draft's folder!  I obviously meant to publish it a few months ago, but somehow didn't. Normally I'd just skip it and not bother, but it does have a link to my ESM presentation video, which I think some peo...

Post has attachment
BSidesAugusta
Yesterday, I was lucky enough to attend the inaugural BSidesAugusta in Augusta, GA.  This was a fantastic high energy event with a lot of gr...
Wait while more posts are being loaded