Leveraging NGFWs for Threat Hunting
Drimacus presents research on operating passive Next-Generation Firewalls (NGFWs) alongside existing detection stacks to enhance network threat hunting and visibility.
Summary
Operational Value of Next-Generation Firewalls
While Next-Generation Firewalls (NGFWs) are traditionally deployed inline for perimeter enforcement, running passive instances provides unique visibility for defensive hunting without risking production traffic interruption.
Overcoming Application Identification Risks
Drimacus shares lessons learned from deploying passive NGFWs in enterprise environments, exploring how deep packet inspection and layer-7 application identification expose covert adversary traffic.
Practical Threat Hunting Workflows
The speaker details concrete detection queries and hunting methodology, demonstrating how blue teams can correlate NGFW flow metadata with endpoint telemetry to uncover anomalous command-and-control activity.
Related talks
Blue Team Village·31 min
Charles Rumford
Charles Rumford challenges overly complex network security designs, showing how simplifying routing and segmentation enhances defensive posture.
Blue Team Village·17 min
Saurabh Chaudhary
Saurabh Chaudhary demonstrates crafting high-performance, modular YARA rules to detect complex malware variants and streamline threat hunting.
Blue Team Village·50 min
Project Obsidian
Project Obsidian details hunting for malicious scheduled tasks, cron jobs, and stealthy persistence mechanisms across enterprise endpoints.