‑Just in this last thing we went over Suricata rules,
EveBox, we got Arkime, we have Triage,
we went over process execution at ANY.RUN and how we can develop that into,
of course, PowerShell,
because any time I ever show up anywhere I say something about PowerShell.
And did I miss something here?
Oh, the config extractor.
I mean really chock full just in this community or ecosystem of
tools that we can use that are available,
and I think really just scratching the surface.
There's a ton of tools out there to work on stuff.
Anything else you'd like to add, maybe some of the tools or anything I missed?
‑No I think that's a great approach.
Look look to the community, look for help there.
There's all sorts of folks out there doing great
things that are constantly sharing it,
so it's not just the multimillion‑dollar vendors.
So whenever you're looking at a malware family or a particular
threat that has impacted your environment, don't hesitate to see
who's already done the research and what tools are out there and
what things can aid you along the way.
And stay curious.
I think one of the biggest things that we have to do is not just
consume data but also understand the threat.
You can go to ANY.RUN or the URLhaus, you can download Dridex samples,
you can drop them in a sandbox, you can observe all the behaviors as we did here.
And that's one way that it can help you sort of stay on the forefront of
knowing when things change. Again, I realize that's easier said than
done, that as a community we're oftentimes very saturated with tasks and
things to do. But at the same time,
if you've got a few minutes to spare, throwing a few Excel docs into a
sandbox and seeing what happens doesn't take too long.
So definitely consider that. ‑I really like that.
Stay curious. We've got to make a sticker or like a T
shirt or something. That's perfect.
Make sure you stay curious by Dr. Josh Stroschein. Thank you so much for
really taking the time and explaining all this to me.
Also this is a great way for me to kind of download, as well as a way for
Pluralsight to be able to share everything back out. and we're going to keep
this up as new things evolve and try to continue to bring the fight back to
the adversary or to the criminal org or whoever it is that's costing us all
this money and slowing down our innovation and technology. That's really the
ultimate goal.
We want to keep our product moving forward and keep everybody safe.
‑Yeah, thank you.
Thank you for the opportunity.
I really enjoyed this time together.
I wish we had an entire day because I'm sure we could fill the time.
It's no longer a problem for me to talk, to fill time.
I usually have a hard time being short,
so I really appreciate the opportunity, and if I can help anyone,
I'm very easy to get a hold of.
Please don't hesitate to reach out.
‑Excellent, thank you for that.
And, hey, this won't be the last one, so we'll talk again.
Thank you for joining us on Pluralsight for this course, Dridex
Banking Trojan and, as always, happy hunting.