BSidesAugusta 2023

Grab your badge and freebies, then check out the CTF, exhibitors, lock pick village, and raffle table.

Grab your badge and freebies, then check out the CTF, exhibitors, lock pick village, and raffle table.

Grab your badge and freebies, then check out the CTF, exhibitors, lock pick village, and raffle table.

Grab your badge and freebies, then check out the CTF, exhibitors, lock pick village, and raffle table.

Live in Track 2, Simulcast in Tracks 3-5

Live in Track 2, Simulcast in Tracks 3-5

Live in Track 2, Simulcast in Tracks 3-5

Live in Track 2, Simulcast in Tracks 3-5

Live in Track 2, Simulcast in Tracks 3-5
In this lively session custom developed for BSidesAugusta, Ed Skoudis will look at the evolving nature of how nation states wield power in cyber space through military and other engagements. Back in the 2000’s, Ed was a member of a US task force working on defining cyber space as a domain for military engagement, along with land, sea, air, and space. In this session, Ed will reflect on the discussions from that time with what we got right, what we got wrong, and how it’s going today. We’ll also look at the implications on mission preparedness and cyber ranges for practice. We’ll consider Cyber Persistence Theory and its application and take a glimpse into where this is all headed, from the perspective of a hacker who got caught up in a series of the most interesting projects in his entire life.

Live in Track 2, Simulcast in Tracks 3-5
In this lively session custom developed for BSidesAugusta, Ed Skoudis will look at the evolving nature of how nation states wield power in cyber space through military and other engagements. Back in the 2000’s, Ed was a member of a US task force working on defining cyber space as a domain for military engagement, along with land, sea, air, and space. In this session, Ed will reflect on the discussions from that time with what we got right, what we got wrong, and how it’s going today. We’ll also look at the implications on mission preparedness and cyber ranges for practice. We’ll consider Cyber Persistence Theory and its application and take a glimpse into where this is all headed, from the perspective of a hacker who got caught up in a series of the most interesting projects in his entire life.

Live in Track 2, Simulcast in Tracks 3-5
In this lively session custom developed for BSidesAugusta, Ed Skoudis will look at the evolving nature of how nation states wield power in cyber space through military and other engagements. Back in the 2000’s, Ed was a member of a US task force working on defining cyber space as a domain for military engagement, along with land, sea, air, and space. In this session, Ed will reflect on the discussions from that time with what we got right, what we got wrong, and how it’s going today. We’ll also look at the implications on mission preparedness and cyber ranges for practice. We’ll consider Cyber Persistence Theory and its application and take a glimpse into where this is all headed, from the perspective of a hacker who got caught up in a series of the most interesting projects in his entire life.

Live in Track 2, Simulcast in Tracks 3-5
In this lively session custom developed for BSidesAugusta, Ed Skoudis will look at the evolving nature of how nation states wield power in cyber space through military and other engagements. Back in the 2000’s, Ed was a member of a US task force working on defining cyber space as a domain for military engagement, along with land, sea, air, and space. In this session, Ed will reflect on the discussions from that time with what we got right, what we got wrong, and how it’s going today. We’ll also look at the implications on mission preparedness and cyber ranges for practice. We’ll consider Cyber Persistence Theory and its application and take a glimpse into where this is all headed, from the perspective of a hacker who got caught up in a series of the most interesting projects in his entire life.

The Remote Desktop Protocol (RDP) is a critical attack vector used by evil threat actors including in ransomware outbreaks. To study RDP attacks, we created PyRDP, an open-source RDP interception tool with unmatched screen, keyboard, mouse, clipboard and file collection capabilities. Then we have built a honeynet that is composed of several RDP Windows servers exposed on the cloud. We ran them for three years and have accumulated over 150 million events including 100 hours of video footage, 570 files collected from threat actors and more than 20,000 RDP captures.

To describe attackers’ behaviors, we characterized the various archetypes of threat actors in groups based on their traits with a Dungeon & Dragons analogy. The Bards, with no apparent hacking skills, make obtuse search or watch unholy videos. The Rangers stealthily explore computers and perform reconnaissance, opening the path for other characters. The Thieves try to monetize the RDP access through various creative ways like traffic monetizers or cryptominers. The Barbarians use a large array of tools to brute-force their way into more computers. Finally, the Wizards, securing their identity via jumps over compromised hosts, use their RDP access as a magic portal to cloak their origins.

Throughout, we will reveal the weaponry of these different characters such as dControl, xRDP Patch, SilverBullet and previously undocumented host fingerprinting tools. Lastly, we will use our crystal ball to show video recordings of interesting characters in action.

This presentation demonstrates the tremendous capability in RDP for research benefits, law enforcement (leverage this open-source capability in ransomware takedowns) and blue teams (extensive documentation of opportunistic attackers’ tradecraft). An engineer and a crime data scientist partnered to deliver an epic story that includes luring, understanding and characterizing attackers which allows to collectively focus our attention on the more sophisticated threats.

Dark allies from the nightmare dimension, on an unholy crusade, have assembled a variety of hacking demonstrations for your education and amusement. Secrets and lies across IT, cloud, and embedded devices will be exposed. Strategies for advancing your asset intelligence aimed at disappointing bad actors will be illuminated. You’ll share this knowledge around the water cooler, apply these security strategies within your organization, and become that awesome person everyone wants to hang out with at office parties, regardless of that Fantastic Four shirt you keep wearing.

What happens when the industrial robot on a factory floor is overlooked in your asset inventory? We’ll demonstrate what that hack might look like and hacks against traditional IT and cloud assets. Stories from the trenches—secrets and lies involving cybercriminals, nation-state actors, and defenders—will be shared. Strategies for creating and maintaining weaponized asset intelligence that will help keep your organization “left of boom” will be detailed.

Weak asset intelligence makes organizations vulnerable to risks ranging from advanced persistent threats to advanced persistent auditors. It only takes one missed, weak device to compromise an entire organization. This weakness and low confidence in the data is frequently a function of data management overload, security tools overload, or slow, error-prone, manual efforts. It’s also challenging to correlate data across different departments, and the relevant intelligence exists in product silos. As your attack surface grows—across traditional IT, cloud, IoT, remote employee devices, and SaaS applications—instead of your asset intelligence being a weaponized source for good, it becomes a parade of horribles.

Nation-states and cybercriminals want this to continue. Cybercriminals have monetized attacks on your assets, and nation-states have built multi-million-dollar tools to target them, maintain persistence, evade detection, steal IP, and conduct sabotage. These bad actors count on you being passive and want you to fail. Disappoint them! Weaponize your asset intelligence.

I have a story about a time me and a few other folks got together and made life difficult for some really bad people that belong in jail. It’s a fun story, and the first part of the story begins at BSides Augusta in 2019, which is why 4 years later I want to tell the rest of the story and how it ends in Augusta.

In October 2022, I received the worst call of my life: my 17-year-old daughter was missing. As a cybersecurity professional with a background in digital network intelligence at the DoD, I immediately knew that I could leverage my skills to find her. In this talk, I will share my experience and techniques that helped me locate my daughter. I will walk through the steps I took, including extracting and analyzing data from her digital devices using a PowerShell script, and how this information was used to get the FBI on board. Through this talk, I hope to provide valuable insights and tips to other cybersecurity professionals, law enforcement officers, and parents on how to use digital data to aid in missing persons cases.

This is not only a personal story but also an educational opportunity to understand how digital data can play a critical role in solving missing person cases. I believe this talk will resonate with the BSides community and will provide attendees with practical skills that can be applied to their own professional and personal lives.

Break

Break

Break

Break

What happens when your most trusted network becomes overrun with potentially malicious activity being carried out by someone you know and love? The real-world experience of a security professional and their teenage child navigating the balance of security and safety while maintaining privacy, respect, and a relationship based on trust and love. This talk goes beyond technology and uses this experience as a lens to understand better and discuss the often-forgotten element in our security practice- the human beings involved.

Process Auditing is a powerful tool in the detection toolbox. According to @Cyb3rWard0g’s research, the vast majority of the adversarial techniques in the ATT&CK framework can be detected with process auditing. Unfortunately, this power comes with a price - process auditing generates a lot of results that can be overwhelming to sift through.

In this presentation, we will walk through a practical option to handle these problems using Security Onion’s Elastic Agent integration as an example. Specifically, we will use @SwiftOnSecurity Sysmon configuration as a source filter and convert it into a format that can be used by Security Onion to filter out known-good results.

LSA-Reaper is an advanced and versatile command line tool designed to facilitate remote dumping of the process. By using Impacket's wmiexec, smbexec, or atexec tools.
The initial step of LSA-Reaper involves conducting a ping sweep across the provided IP addresses or IP ranges. This reconnaissance enables the tool to identify live hosts to prevent timeouts. Once the live hosts are successfully detected, LSA-Reaper proceeds to create an SMB share with a randomly generated username and password. This SMB share serves as the exfiltration point for LSASS dump and as the host for the payloads. Ensuring that the payloads are never written to disk on the Windows hosts.
LSA-Reaper then runs the net use command on the victim’s machine through Impacket’s wmiexec, smbexec, or atexec, LSA-Reaper orchestrates the mounting of the previously created SMB share as a network drive on the target system. This critical step facilitates data transfer and enhances the overall effectiveness of the LSASS extraction process.
The final stage entails the execution of the selected payload such as msbuild, regsvr32, calc.exe, or an EXE file. By employing these utilities, LSA-Reaper successfully extracts the LSASS data and directly saves it to the mounted SMB share. This approach offers an added advantage as it bypasses Windows antimalware systems that may attempt to delete or interfere with the LSASS dump file.
Finally, LSA-Reaper includes a feature that will automatically bypass the RunAsPPL security feature by leveraging a signed driver that comes bundled with MSIAfterburner to elevate the payload’s process to a PPL with the LSA signature enabling the payload process to interact with the LSASS process without modifying the security level of the LSASS process.

R.R. Coveyou famously titled a 1970 article, "Random Number Generation Is Too Important to Be Left to Chance". In this presentation, I will recap the importance of randomness in computing and the current landscape of pseudorandom and true random number generation. I will also discuss the promise of quantum random number generation from radioactive decay to the use of quantum states of light to gather entropy from a quantum origin. Finally, I will discuss the question of 'trust' in random numbers generated by quantum means.

Enjoy lunch provided by Chick-fil-A! A vegetarian option will also be available.

Enjoy lunch provided by Chick-fil-A! A vegetarian option will also be available.

Enjoy lunch provided by Chick-fil-A! A vegetarian option will also be available.

Enjoy lunch provided by Chick-fil-A! A vegetarian option will also be available.

A couple of years ago, I stumbled into the world of law enforcement Digital Forensics and Incident Response (DFIR). This talk will share my journey into and discovery of a new niche of IT I didn't know existed.
Come for an introduction to the hardware, software, processes, and people of DFIR.
Learn how those pieces work together to gather data, review, build a timeline, and put the bad guys behind bars.
Leave with the curiosity to head home, image your phone/computer, and start digging around in your own data.

The next generation of cybersecurity engineers will be data engineers who happen to specialize in cybersecurity. This talk aims at showing how cybersecurity engineers can benefit from today's technology to make sense of the sea of data that they are gathering. Currently, we are constantly bombarded with information about GPT, ML, AI, and a variety of abbreviations. The question is, though, how can we as cybersecurity engineers capitalize on these tools? I will answer this question with a concrete example of the usage of ML and AI from the perspective of a cybersecurity researcher. The goal of my talk is to show that, with today's tools, a cybersecurity professional can make new discoveries and invent creative ways of using cybersecurity data for business solutions.

First, I will dive into the types of data we encounter in the cybersecurity ecosystem. Then I will analyze the framework of exploratory data analysis (EDA), which includes statistics and visualizations to make sense of an opaque dataset. I will give solid examples of how we engineer features from our data. Finally, I will demonstrate the use of AI to "question" your data, help you draw conclusions, and create models to detect malicious behavior.

This talk includes a demo with Jupyter notebooks and public packet capture data. It demonstrates how we can capitalize on packet captures to discover malicious activity using Pandas AI, Scikit LLM, and a variety of Python libraries. The audience is taken through the journey of raw data, exploratory data analysis, feature engineering, and finally modeling. Through this journey from raw data to models, I aim to describe the possibilities that ML and openAI models have opened for cybersecurity engineers to be creative and resourceful. The code for this talk is in the repo: https://github.com/mundruid/bsides-augusta-2023.

The offensive industry is about exploring what’s possible. Part of this is observing and taking lessons from other disciplines that have already solved a myriad of related challenges, from proper software engineering practices to using graph theory for offensive problems. But despite various leaps forward over the last several years, the offensive post-exploitation community has yet to fully embrace data analysis and enrichment pipelines beyond basic log aggregation and searching. If offensive tools were structured for automated processing instead of solely human consumption, we could unify post-ex data to exploit the known (and unknown) relationships within the data our offensive tools emit.

Imagine a system that could ingest data from any C2 framework or post-ex tool, and could not just automate common operator tasks like binary analysis for known vulnerabilities and hash extraction and cracking of encrypted documents, but could perform complex offline analysis like host privilege escalation. If we could unify all post-exploitation data from offensive engagements we could improve operator workflows, provide tradecraft assistance, facilitate automation of onerous tasks, and uncover new data-driven research opportunities. A year ago, our team embarked on the development of just such a system, and we are excited to introduce the result of our effort: Nemesis.

This presentation will start by detailing the various red team challenges regarding data, leading into how this influenced Nemesis’ architectural decisions and design. Along the way we’ll cover various time-saving automations Nemesis can perform along with offensive data enrichments and analytics the engine can produce. This is the start of a true universal operator assistance platform, with operator guidance contextualized by data as it comes into command and control platforms. Beyond this, Nemesis will enable the emerging discipline of offensive data analysis, which we hope will unlock possibilities we can’t even imagine.

In the relentless battle against ransomware, comprehensive analysis is crucial for effective defense and mitigation. This talk aims to empower attendees with valuable insights and techniques to uncover critical artifacts and enhance their analysis efforts against ransomware attacks. During this session, we will explore the key artifacts left behind by ransomware operations, shedding light on their significance in the analysis process. Attendees will gain a deeper understanding of ransomware techniques commonly employed by threat actors. By leveraging these techniques we will discuss, attendees will be able to extract deeper insights from artifacts and gain a more comprehensive understanding of ransomware operations. By attending this session, security professionals will enhance their ability to analyze ransomware attacks, identify indicators of compromise, and develop effective mitigation strategies. The knowledge and techniques shared will enable attendees to illuminate the hidden artifacts within ransomware operations, leading to enriched analysis and improved incident response capabilities.

ChatAPT is a cybersecurity red-teaming framework which demonstrates the emerging threat possible by leveraging Large Language Models (LLMs) such as GPT to elevate high-fidelity social engineering effort to an unlimited scale.

There are over 3 billion Chrome users across the globe, with nearly 200,000 active Chrome extensions available in the Chrome webstore. Chrome extensions have garnered increasing popularity and have become so ubiquitous due to their ease of installation, additional functionality, and customization options. The demand for sophisticated Chrome extensions has become a gateway for attackers to exploit browsers and sensitive information. According to industry data, there was an increasing trend to install malicious extensions, resulting in over 1,300,000 install attempts between 2020-2022.

With Chrome extensions possessing privileged permissions, attackers can not only get unauthorized access to high value data but can also change the browser behavior by injecting malicious code, leading to critical attacks like XSS and CSRF. Malicious extensions can exfiltrate data unbeknownst to the user, resulting in a breach of privacy.

No single Chrome security control can fully protect against all exploitations, but a layered approach has a proven success rate. Protecting against malicious extensions requires a multifaceted approach. Not only is a foundational knowledge of browser interactions necessary, but also an understanding of how the extension manifest dictates the permission, privacy, and security of an extension. Furthermore, additional layers to this pipeline should be default-deny, security extension analyzers, and leveraging browser isolation agents to investigate the extension behavior post-loading.

In conclusion, this presentation will cover the pressing security concerns surrounding Chrome extensions, inform of the present challenges of the available solutions, and highlight our company's innovative approach to mitigating these risks. By implementing robust security measures with enhanced control and monitoring capabilities, we aim to significantly reduce the threats associated with Chrome extensions, ensuring a safer and more secure browsing experience.

The need for cybersecurity in critical infrastructure environments (e.g., energy pipelines, power plants, nuclear facilities, petrochemical sites, water treatment plants) is at critical levels. In this discussion, we’ll be looking at the current state of cybersecurity in these types of ICS/OT environments, including interesting developments in the ICS/OT attack landscape. We will also look at top ways to secure these specialized environments and reduce the risks associated with cyber attacks.

API security is so hot right now! Organizations don’t fully understand APIs, how to find them, and secure them. This can feel scary. Don’t Panic. Grab your towel and join me on a meme adventure to explore the API galaxy. We’ll cover the history of APIs. Why people now suddenly care about them and why they’re such a hot topic. We’ll go over some ways to identify APIs within an environment. We’ll cover how API security is different and how to start securing them. We’ll review the API security tooling landscape. Finally, we’ll review resources to get your towel wrapped around API security and answer the ultimate API questions.

Break

Break

Break

Break

Most SOCs are unable to keep up with the attacks of today due to structure constraints surrounding outdated architecture. That structure does not scale to protect the rapidly changing, distributed environments that SOCs are required to defend from attackers that have risen in both number and sophistication. To counter, SOCs must evolve to become 'Next-Gen'. This talk will present concrete steps organizations can take to evolve from today's rigid structures into a dynamic, agile entity that can quickly react to threats of today and tomorrow. The presentation groups these steps into three phases demonstrating clear paths to grow people, modify processes, and change technologies. Additionally, recommendations will be given for adaptations that still provide the advance capabilities needed to protect a variety of enterprise types. Organizations can use the strategies discussed in this talk to help them develop multi-year plans that can protect the enterprise.

The rise in ransomware attacks and third-party breach notifications has contributed to reducing the global mean time to detection (MTTD). So, adversary dwell time is likely much higher than perceived. We must also consider the "unknowns unknowns" that allow attackers to lurk casually on our networks like silent ghosts. In this talk, we will look at a blue team tactic for Microsoft Windows environments that will help reduce the dwell time of ghouls feeding on our sensitive data and the ghosts haunting our networks. A demo at the end will showcase one way to operationalize the information presented using a custom tool.

Security relies on trust, especially when it comes to Certificate Authorities. Browsers ship with many root CAs built in, but are they all equally trustworthy? I examined over 5 billion recent TLS certificates and now I know! In this session I’ll reveal the most and least trustworthy CAs, factors influencing their trust ratings, and how to use this data to protect your organization.

JWTs are an incredibly flexible tool that make life easier for developers because they are standardized, widely supported, and include important security features by default. However, like any powerful tool, JWTs can be dangerous when used incorrectly, or for unintended purposes. In this talk, I aim to shine a light on common JWT misuse and abuse. I'll start by briefly describing JWTs and common use cases for them. I'll then present real world scenarios of misuse and abuse from applications that I've tested as a consultant, and written as an engineer. As I present each scenario, I'll demonstrate the various features and failures live, and discuss how the specific implementation of JWTs can be hardened. The end result will be an enlightening and entertaining presentation of information and experience that will provide the viewer with a practical knowledge of how, and how not, to use JWTs.

This session will answer questions related to hacking using radio frequency (RF) devices. We will review past RF hacking events (both those that have happened and those of urban legend). We will discuss common RF hacking tools such as the Flipper Zero, HackRF, and more. Then we will touch on setting up a space for RF experimentation and the types of programs one might want to support RF work such as GNU Radio.

In the realm of cybersecurity, the continuous evolution of malicious threats necessitates robust detection mechanisms. Traditional signature-based detections, which rely on predefined patterns or signatures of known threats, have long been employed to identify and mitigate malicious activities. However, the rising sophistication of cyberattacks, characterized by polymorphism, obfuscation, and zero-day exploits, has exposed the limitations of signature-based approaches.

This talk delves into the paradigm shift towards behavior-based detections as a superior alternative to signature-based methods. Behavior-based detections focus on analyzing the dynamic actions and patterns exhibited by software, users, or entities, enabling proactive identification of anomalous or malicious behavior. By studying the inherent characteristics of behaviors, such as sequences, frequencies, and contextual relationships, behavior-based detections transcend the constraints of static signatures.

The key advantages of behavior-based detections lie in their adaptability, effectiveness against unknown threats, and resilience against evasion techniques. Unlike signature-based detections, behavior-based approaches are not reliant on specific signatures or patterns, allowing them to identify previously unseen threats that evade traditional methods. Moreover, behavior-based detections excel in capturing contextual information, understanding normal usage patterns, and flagging deviations from expected behavior.

This talk explores various techniques employed in behavior-based detections, including machine learning, anomaly detection, heuristics, statistical analysis, and how to properly share knowledge through Alerting and Detection Strategy writeups (ADS). It discusses the merits of these techniques, highlighting their ability to detect zero-day attacks, polymorphic malware, advanced persistent threats (APTs), and insider threats. The challenges associated with behavior-based detections, such as false positives, resource requirements, and privacy concerns, are also examined.

The analysis and comparison of behavior-based detections with signature-based detections demonstrate the superiority of behavior-based approaches in terms of early detection, reduced false negatives, improved response time, and enhanced adaptability. The effectiveness of behavior-based detections in various real-world scenarios is illustrated through case studies and empirical evaluations.

Ultimately, this talk advocates for the widespread adoption of behavior-based detections as a cornerstone of modern cybersecurity strategies. By embracing the dynamic nature of behaviors and leveraging advanced analytical techniques, organizations can fortify their defenses against emerging threats, ensuring the security and integrity of their digital ecosystems.

The recent surge in the advancement of large language models (LLMs) like GPT-4 has brought new complexities to the cybersecurity sphere, significantly diminishing the "time to exploit" from a duration of months and weeks down to mere hours and minutes. In this presentation, we will delve into how LLMs can effectively generate viable exploits for a wide variety of Common Vulnerabilities and Exposures (CVEs). The increased speed at which these exploits can be created calls for a swift adaptation from cybersecurity professionals, necessitating a better understanding of the capabilities of LLMs and the implications of their rapid exploit development. This presentation will further shed light on how the quality and amount of input information - ranging from CVE descriptions to vendor documentation - can significantly influence the success rate of the malware code generated by these models. Essentially showing how simple CVE descriptions, designed for good, give AIs enough information to create working exploits. We will explore the creation of exploits for a specific CVE under multiple scenarios, leading to a detailed comparison of the resulting code. This discussion highlights the urgent need for cybersecurity professionals to grasp and tackle the issues brought forth by LLM-powered exploit creation. We will delve into the tangible implications of these findings on aspects of vulnerability management, patch prioritization, and threat detection. These illustrations will effectively portray the gravity of the situation in light of the expedited "time to exploit" made possible by LLMs.

As many in the security industry are all too well aware, malicious cyber actors often like to target victims when they may be asleep at the wheel or enjoying some time away from the keyboard -- think Friday night mass exploitation parties, or playing the role of the Grinch on Christmas. But what do you do when the gift you wake up to on Christmas morning turns out to be a years-old intrusion by a stealthy nation-state threat group? Sometimes the answer is to play the game by their rules. This talk will examine just such a case in which Rapid7's Managed Detection & Response and Incident Response services uncovered--and subsequently eradicated--an advanced Chinese threat actor from a customer network by turning the adversary's playbook on its head.

Honeypots and other deception techniques have existed for decades but rarely are they deployed in most production environments. In this talk we’ll dig into practical and easy ways to use deception and do our best to fix that gap. More specifically, in this talk we’ll share ready to deploy and customize honey tokens, honey documents and similar tools ready to be used in your organization. We’ll work with Security Onion as our detection platform and show you how to get deception deployed quickly and easily to the detriment of the cyber criminals and benefit of your defenses!

This talk is about leveraging open source intelligence to track and detect rapidly-changing initial execution techniques used by adversaries. You’ll learn about TA570 and TA577, two threat groups that continuously research, test, and implement new ways to download and run malicious payloads on victim endpoints. One of their favorite payloads is Qbot (aka Qakbot), a fast-moving trojan that can lead to ransomware. Detecting evil execution early can reduce or eliminate the risk of follow-on activity, but frequent changes to Qbot downloaders makes early detection more difficult for defenders. Fortunately there are analysts and researchers dedicated to tracking such changes and sharing them with the security community almost as quickly as they happen.

You will leave the talk understanding how you can use open source intelligence to help you track changes adversaries make to their initial execution techniques, like in the example above. You’ll be given specific resources you can use to stay up-to-date as threats continue to change and develop. You’ll also be armed with detection opportunities to help detect loaders delivering malware like Qbot. Newcomers to cybersecurity will learn about techniques prevalent in today’s threat landscape. More experienced analysts will go home with up-to-date behavioral and atomic indicators for initial execution detection.

In the evolving landscape of cybersecurity, professionals are often inundated with vast amounts of data. Splunk has been a game-changer in analyzing and visualizing this data. However, crafting precise queries in Splunk’s Search Processing Language (SPL) requires expertise and can be time-consuming. Enter SplunkGPT – the start of a solution that harnesses the power of GPT-3 to transform natural language queries into SPL, making data retrieval more intuitive and efficient.

In this talk, we will journey through the development of SplunkGPT. We will start by exploring the capabilities of OpenAI's GPT-3 in processing natural language queries. Through live demonstrations, we will observe how GPT-3, in its vanilla form, can handle basic queries but falls short when faced with complex, domain-specific questions.

Recognizing these limitations, we will delve into the world of fine-tuning GPT-3. We will unravel the process of collecting domain-specific training data, creating templates, and refining GPT-3 to understand the intricacies of SPL and cybersecurity data. The audience will gain insights into the challenges and best practices of fine-tuning a language model for specialized tasks.

Next, we will unveil the architecture of the semantic parser that integrates the fine-tuned GPT-3 model. We will discuss how this parser converts natural language queries into SPL queries, and how it is seamlessly integrated with the Splunk database.

Finally, we will explore the broader applications and implications of this technology in the cybersecurity domain, followed by an interactive Q&A session.

Have you ever wondered where you stand among the cybersecurity community? We’re reviewing 30 questions that test your Threat Hunting Maturity with brief discussions that reveal the answer to each. This talk is packed with up-to-date, real world TTPs by Advanced Persistent Threats as well as knowledge of the use of EDRs and SIEMs. This presentation is based on an assessment I’ve titled the Threat Hunting Maturity Exam which gives me a quick snapshot of the strengths and weaknesses of SOC Analysts and Threat Hunters. Come join the discussion. Answer all the questions and show everyone your skills or sit quietly and learn stuff. No judgement zone.