Hello, and welcome to Threat Intelligence with MSTICPy.
My name is Ian Hellen.
I'm a principal software engineer in the Microsoft Threat Intelligence
Center and the creator of the MSTICPy Python package.
In the module,
we'll be looking at how you can use Jupyter Notebooks to
supplement and extend your hunting and investigation
capabilities in your security operations center.
MSTICPy is a cybersecurity toolset for Jupyter Notebooks,
and we'll be using some of the features of the
package in our example investigations.
We'll start with an introduction to using Jupyter Notebooks and
MSTICPy in your security operations center.
We'll look at some of the advantages that Jupyter Notebooks have over
traditional SOC tools and give you a bit more background to MSTICPy.
Then we'll look at three examples from the MITRE ATT&CK techniques framework,
valid accounts, scripted attacks, and third,
persistence with Windows scheduled tasks.
In the first of these,
we'll use some techniques like time series analysis to detect
anomalous logon patterns and some visualizations that can help
distinguish attacker activity from normal activity.
In the scripted attacks section,
we'll look at an example of detecting and unraveling
encoded Windows PowerShell attacks.
In the final section,
we'll look at how to identify potentially hostile task creation events,
and understanding and deciphering what the attack is doing.
As a companion to the course,
we provide the complete Jupyter Notebook and the sample data used in the course.
In order to follow the course and to run the notebook,
you will need a Python environment capable of running Jupyter Notebooks.
Some familiarity with Jupyter Notebooks and Python is also needed.
I look forward to you joining me on this exploration of the
power of Jupyter Notebooks in InfoSec.