NeXpose for Automated Compromise Detection

Explore automated compromise detection using NeXpose in this 28-minute conference talk from DerbyCon 4. Dive into topics such as indicators of compromise, authenticated scans, and the jessjs example. Learn about the strengths and limitations of this approach, including what it means for security and its imperfections. Gain insights into Jet Script and XML Script, and understand the overhead involved in learning JS. Discover why NeXpose doesn't have this feature built-in and explore the relationship between NeXpose and Rapid7. Conclude with a discussion on Security Street and the challenges of limited documentation in this field.

Syllabus

Intro
Who am I
Indicators of Compromise
authenticated scans
jess
js example
What does it mean
Its not perfect
What I learned
Jet Script
XML Script
Takeaways
Overhead
Learning JS
Why NeXpose doesnt have this feature
NeXpose and Rapid7
Security Street
No Documentation