Episode 29: Olaf Hartong

Two years and 28 episodes later, our first guest: Olaf Hartong of FalconForce rejoins Jared and Jonny in the studio. Olaf, as well as Jared, Jonny, and Luke will all be Blackhat instructors this year - and our collective opinions on Threat Hunting and Detection Engineering have evolved enough over the years to warrant further discussion. We hope you join us!

--------------------------------------------------------------------------------------------------------------------
0:00:00 - Intro
0:00:32 - Olaf's Training Accepted to BlackHat USA
0:04:17 - Phased Approach to Detection and Response
0:09:53 - Telemetry and Detection Engineering
0:22:37 - MDE Telemetry Collection Deep Dive
0:26:43 - Client vs. Server-side Telemetry
0:38:54 - Signal Detection Theory and Alert Classification
0:45:39 - Detecting Malicious Service Creation
0:52:28 - Information vs. Data
1:04:10 - LSASS Dumping Operation Chain
1:07:00 - Necessity and Sufficiency
1:13:48 - Balancing False Positives/Negatives
1:24:05 - Possible Reunion Plans Discussed