Red Canary SecOps Weekly: Episode 44 – Decoding normal vs. anomalous behavior

Episode 44: Naughty Or Nice

 

Keith is joined by Brittany Sattler and Tyler Winchester, threat hunters at Red Canary, as they break down why context matters when trying to decode between normal and anomalous behavior. A big part of this comes from having a baseline of how a user typically behaves, by identifying network spikes or abuse of normal protocols.

The two outline how Red Canary plans, executes, and reports on hunts, and give tips on how teams can better operationalize their own through tools like Surveyor.