Master Anomaly Detection - Advanced Threat Hunting for Identity-Based Attacks

Join threat hunting experts Tyler Winchester and Brittany Sattler in this 37-minute Red Canary Office Hours episode as they explore advanced methodologies for detecting identity-based threats that evade automated security systems. Dive deep into a comprehensive case study demonstrating how to identify compromised identities through adversary-in-the-middle phishing attacks by analyzing authentication patterns across multiple data centers within specific time windows. Learn practical approaches to establishing user behavior baselines, developing effective hunt hypotheses, and integrating organizational intelligence to differentiate between legitimate and malicious activities. Discover how to overcome the unique challenges of identity threat detection compared to traditional endpoint security, utilize pseudocode for developing hunt methodologies, and leverage analytical tools like Jupyter Notebooks for data investigation. Master the art of combining external threat intelligence with internal business context to enhance detection accuracy while minimizing false positives from common scenarios such as impossible travel alerts and VPN usage patterns.