Hunting for Hackers with Sigma Rules

[@jayinfosec]

There is a lot of haters on Sigma... Nas even said, "many people tell him he isnt good at detection engineering" - meanwhile, every vendor and enterprise is using their rules.... Sigma is freakin awesome!!

[@imveryhungry112]

sigma sucks. it looks like they4re trying to tailer it to just work for very specific vendors. Fuckin lame.

[@xCheddarB0b42x]

This was fantastic upload. Can't wait to play with these detection rules. Thank you both!

[@stunnx4421]

This was great! Thanks, both of you!

[@shadisukkar]

Is there any potential that Wazuh becomes a supported backend for Sigma?

[@hamidb75]

This was great and very informative for detection, Thanks a bunch to both.

[@bing_crilling8981]

patrick bateman cybersecurity

[@SQUIFFYx17]

😂😂😂

[@user_9f47l38]

I love that movie

[@xakcisx]

So sigma

[@crusader_]

Banger thumbnail

[@Hybrid_Netowrks]

John can Sigma support in converting AIX binary logs into Splunk format?

[@demotedc0der]

this is literally a next level type of detection system

[@Wca2e9315]

Can you hunt the Lazarus syndicate?

[@HeyDudee]

John You da best 🔥🔥

[@KCM25NJL]

I guess the obvious question now, is what would a threat actor do to fly under the sigma radar?

[@xCheddarB0b42x]

Fuzzing or other obfuscation and also patience. Separate actions with time.

[@-BANKAI-n1]

I can't get sigma rules to work with insightidr, even the converter failes to process the rules.i'm doing something wrong or is it not yet supported?

[@-BANKAI-n1]

Nvm, i found out while typing the message: The InsightIDR backend supports the following log entry/rule types: Process start events DNS query events Web proxy events Firewall events Ingress authentication events

[@Revoku]

a bunch of streamers/youtubers are going on about call of shames anti-cheat acting like it has malware, imo you should have a nosy at it, bet you can sort out all the drama in no time flat

[@squid13579]

Full time: Batman Part time : cyber security😎

[@-robotsea-6846]

John, I swear all I hear is Seth Rogan when you are talking. Man I'm dying over here. But long LIVE sigma. Haters gonna hate.

[@Aurora.Astralis]

My name is Aurora which made me a little confused when I kept hearing/seeing it

[@SzaboB33]

Sigma rules! XD

[@everypizza]

🗿 phonk security

[@wolfleader2]

What the sigma

[@alkassirabumustafa7875]

Hi

[@MysteryMan159]

Still waiting for vim plug-ins exploits 😎

[@mauritaniainjector3736]

Talk on palastin 😢

[@Sudhanshu0761]

Nice

[@imveryhungry112]

How the f do you convert these to like sql queries? Noone will ever get to the point.

[@syedbarkath6960]

John why the quality and presentation of the video changes if you are with other hackers? That s need to be same.

[@amirhosseinamiran]

Thanks for content ❤❤❤ I can hack just for you man

[@stickysimon0379]

Teach us how to write a simple computer code for python and windows

[@Salim-b4x7c]

Second 😂

[@DZDZDZDZDZDZDZDZDZDZDZDZDZ-w4n]

Firs

[@Gyhvthhfdcvv]

first

[@xakcisx]

No

[@DZDZDZDZDZDZDZDZDZDZDZDZDZ-w4n]

I am first