Life and DEaTH: building detection, forensics, and intelligence at scale

Friday 4 October 14:30 - 15:00, Red room

Selena Larson & Konstantin Klinger (Proofpoint)

How can threat intelligence and detection teams build a collaborative, productive relationship and improve overall organizational security? Our talk will focus on how detection engineering and threat hunting (DEaTH) informs detection pipelines to enable automated forensic analysis of the biggest threats to enterprises, and how security practitioners can use this type of data to improve their own defence.

Each day Proofpoint analyses billions of emails, and millions of those are identified as malicious. We will discuss how to work together with cross-functional teams to identify new techniques and create detections to prevent threat actor exploitation at scale, while automating configuration and forensic extraction, and MITRE ATT&CK mapping for end-users.

This talk will provide an in-depth look into the CTI and detection lifecycle and the symbiotic relationship between threat hunting and detection engineering and how researchers and organizations can leverage it in their own defence processes. We will demonstrate multiple case studies from both cybercrime and APT threat actors. Each example will provide examples of challenges in automated detection and forensic extraction and highlight the tactics, techniques, and procedures (TTPs) used in each campaign that have been observed across the threat landscape.

Selena Larson Selena Larson is a senior threat intelligence analyst at Proofpoint on the Threat Research team. She collaborates with fellow researchers to identify and investigate advanced threats and develop actionable threat intelligence. Selena is also the co-host of the DISCARDED podcast, featuring unique research and insights from individuals in the infosec industry. Previously, she was a cyber threat analyst for the industrial cybersecurity firm Dragos, and a cybersecurity and privacy journalist.

Konstantin Klinger Konstantin Klinger is a senior security research engineer at Proofpoint on the Threat Research team. He’s punching phishing and malware miscreants by employing static and dynamic signatures, while also engaging in the active development of the sandbox. His primary objective is to automate detection, detonation, and configuration extraction (DDX) on a large scale. With a background in government intelligence, he dedicated years to network security monitoring. Before returning to Proofpoint, he acquired valuable incident response experience at Apple.

Back to VB2024 Programme page

Back to VB2024 conference page

Register for VB2024

Other VB2024 papers