Unspoken Security Ep 21: Could We Make Everyone a Threat Hunter?

I've had a plethora of experiences. I've done and seen a lot of things, and I have a very unique perspective of threats and a ridiculous passion for defense. I like chasing the bad guys and getting rid of them, however that may be, and protecting the good guys. You know, the greater good is not why I joined the military, but I mean, it all works out. That's just how I got to where I'm at. I enjoy telling people and trying to help them improve their defenses, being more proactive so these bad things don't happen, and then also making sure that they're faster in responding as well. I've been helping and pushing really hard within Sysdig to really amplify that defense is proactive and reactive. Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Legends are made. Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly at NSA. Been building and maturing intel programs in the private sector for about 8 years, and I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! And I continue to be deeply committed to servant leadership. This podcast brings all of these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not your typical polished podcast. My dog makes occasional appearances. She's not around today. People argue, we debate, we even swear. I certainly do. And that's all okay. Think of this as a podcast. It's really a conversation like one you'd hear at a bar, maybe after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. Now, before I jump into the guest, I want to preface by saying I'm in the process of recovering from pneumonia. So my voice is a little rough and I may mute occasionally to cough because nobody wants to hear that in the mic. But I'm going to be here because we got to get a good show in today. We got a great guest, but that's why I'm a little rough. Trust me, I'm fine. So today, that guest I mentioned is Crystal Moran. She's a cybersecurity strategist at Sysdig. She's tasked with bridging the gap between business and security through cloud and container-focused webinars and papers for everyone from executives to technical practitioners. She was originally a threat researcher, a threat research engineer actually, on the Sysdig threat research team, where she spent her time discovering and analyzing cyber threats who took advantage of the cloud. She started her career much like myself as a linguist and an intel analyst in the U.S. Air Force. I'm sure she was better at both than I was. And prior to joining Sysdig, she spent 4 years as a contractor for Booz Allen Hamilton researching and reporting on terrorism and cyber threats. She was also responsible for helping to develop and mature Booz Allen's cyber threat intelligence community and threat hunting capabilities. So we have some similar backgrounds, although, uh, hers is a little more interesting in my opinion. Crystal, is there anything I left out of your bio? Anything you want to add?

No, I think we're going to dig into all of that today. And the only reason it sounds so cool is because I had some really great people help me write it.

Nice. Nice. Well, like good intel people, I'm sure you're pretty modest and humble too. A lot of it's very cool stuff, but yeah, writers often help as well. So today the topic of our conversation is, could we make everyone a threat hunter? You know, threat hunting content comes up occasionally in conversations along many other different parts of the career fields in security. But the concept of could we make everyone a threat hunter is something I haven't heard anybody talk about. Now, not everybody knows what threat hunting is, so I think we should really start by giving some baselines, you know, coming straight from the expert, you know, you in this case, what is threat hunting and how did you work your way into this segment of cybersecurity?

All right. So first of all, threat hunting is proactively looking for threats in your environment. This is not an oh shit incident response. We have this alert and somebody's doing something. This isn't the case. Threat hunting is we don't know they're there, but let's see if we can find them. So it's very similar to the scientific method that you learned in middle school, high school, right? So establishing a hypothesis, which is a statement or a question that you want to answer. Typically in cyber threat hunting, it's going to be Has this group breached us or are we affected by this vulnerability? That's in essence what a threat hunt is going to look like. Scientific method, you're gleaning information from observation, experimentation, and analysis. You don't know if your hypothesis is actually true or not. I've seen a lot of times where a threat, the threat hunt process stems from a CVE is reported in the news. You start seeing it on all of the cyber media outlets and your CISO reads one of those articles. CISA and FBI says this nation-state threat actor is actively exploiting this CVE and they are targeting this business sector. Well, guess what? Your organization is in that business sector. You are a manufacturer or you are a defense contractor. So that concern distills down from the board or the CISO all the way down to the SOC. And you can ask the same question, are we affected? Okay, well, let's go find out. And that's basically how a threat hunt starts. You go and you take the information that you know about that vulnerability or about that threat group, and you try to go find them. Ideally, you don't want to find them because you don't want to find China or North Korea or what have you in your network, but it happens and that's okay. The good thing is you did actually identify it. Hey, and you move on from there with your incident response process.

Hmm. So it's interesting you mentioned not wanting, and I'm sorry to interrupt, I know you have more answer for this, but not wanting to find them, right? And I think that's something I want to jump in on real quick because that's true, right? The goal is, hey, we hope this isn't in our system, but how hard is that? To communicate? How hard is that even to believe yourself, right? You know, have, have we done everything we could possibly do, right? You know, the lack of evidence of existence doesn't mean they're not there. Also, you know, we could be wrong, but how hard is it to be comfortable and confident that, hey, we didn't find it, we're confident they're not here, and we move on? Or do you just keep trying over and over again? Like, how do you convince folks, yeah, there's nothing in here, we're good?

Yeah, I mean, that's probably a whole nother conversation in and of itself, is to what point do you determine that we are secure and we do we do not see any evidence of a threat actor in our organization, or we are confident that our detections will capture this kind of activity. Again, it goes back to just constantly testing and theorizing. And that's really where these threat hunters come into play, is that's their job, is to literally just continue pushing the boundaries and making sure that there's no one there. You asked how I've gotten into threat hunting.

Yeah, exactly.

Like you said in my bio, I've been hunting in various ways and for a very long time now through career choices or forced careers, like not being able to pick my own language as an Arabic linguist, or just choices that I've made in my experiences and opportunities. I've slowly transitioned from hunting people and patterning people to looking at network patterns. People, cyber people, and now just I don't care who they are, they're just doing bad things. It doesn't matter if they're a terrorist or not, or just Joe that lives down the street. So now I use all of that knowledge and experience from patterning personas, and I'm not threat hunting anymore per se, but I work closely with our threat research team and I advise organizations in building and maintaining their security all around. And like you said, trying to defend them and stop these bad guys. And sorry, my— I have a whole pack in the back and they're going absolutely nuts right now.

Not a problem. I'm a big dog fan. Everybody else, to be honest with you, as I started hearing it, I couldn't tell for sure if it was your dogs or my dogs. I was actually looking at my own mic trying to figure out, is that my dogs that just came home or is that your dogs? So listen, if you're a fan of the show, you're a fan of dogs. There's no way around it. That's just how it works. Dogs and kids and life. Show up and like I've always said, this is, you know, live honest conversation. Don't plan on cutting any of it out. If the dogs jump in and get on camera, that's even all the better as far as I'm concerned. But, but I think you make some interesting points here, right? You know, you were hunting all the time, right? You were hunting people. For those who don't know, linguists rarely get to pick our own languages. You were Arabic. I was Serbian and Croatian. It wasn't obviously the top of my list necessarily, but you went from hunting people and, you know, analyzing pattern of life, right? To, to the network patterns, as you said. And now it really doesn't matter who it is, right? The, the people don't matter. The back— background of who's doing it doesn't matter. It's all about just hunting for things that don't belong and then figure out how to mitigate those things. So I think that's a really important point because a lot of people do transition at Intel from role to role. And a lot of times it comes down to, you know, how do your skills translate between these different roles? And I think you're a good example of that, right? So you weren't in threat hunting originally. You weren't in cyber originally, right? You were a linguist chasing Arab, you know, Arabic linguist, I'm gonna guess, chasing terrorists and counterinsurgency and that kind of thing.

Sort of like my own. Yeah, pretty much.

Yeah. Sort of like my own role. And, and then, you know, look, now we're both chasing, you know, bad guys in the digital space. I think it, I think it's an interesting progression, right? But I think I appreciate, you know, it gives people a good understanding when we talk about what threat hunting is. You know, you made a really good point that this is looking for things that you don't know if they exist or not, right? This isn't incident response. I think people sometimes confuse the two. And start thinking they're the same and they're not. You're hunting for something because you heard an outside source said a thing could exist. You don't already have indications it's even in your environment. I'm gonna guess on this case that makes you somewhat dependent on intel, right? So if somebody says, hey, you know, APT throw in a number, ATT&CK organization someplace, and we look similar to that organization, do we have APT throw in a number in our environment?

Exactly.

Do you start then by going to check intel? Like, hey, what do we know about this APT? What should we be looking for? Right? What are the indicators? Is that where this starts? Is that intel fuels you and then you go chase down those things?

That's where it starts. The SOC lives and breathes off of threat intelligence, right? And that is a specific role in and of itself. Cyber threat intelligence analyst is a position. I've held it. But every member of a SOC incident response, they're just going to keep going. Threat hunters, they all do their own research and analysis too, right? Like we're all constantly reading the news and seeing what's hitting the headlines. But some teams do have folks that are dedicated to gathering that information and knowing in-depth what these different APT groups, what exactly they're doing. MITRE ATT&CK TTPs, right? Their tactics and their techniques. How do they operate in a network? And these CTI analysts follow them daily, weekly basis, and they can tell who's who based on how they're behaving. Or you just throw it in the cybercrime bucket because it's a crime of opportunity kind of thing and it doesn't matter who they are. But the big one would obviously be focusing on APTs.

Yeah, got it. Okay. That makes sense. I mean, obviously as an Intel guy, I assumed that would be the answer. I'm not going to lie. I've worked that way before, but you always want to check and make sure. Plus, that's good to put a plug in there for all the CTI teams out there working hard to provide intel. This is another area where it goes, right? Intel goes to hunt, intel goes to red team, intel goes to all these other places. It's hard to be successful. Hunt wouldn't be successful if you don't know what to hunt for, right? So you have to have these profiles and some of these things to chase down. All right. So you mentioned when you were in, in the background here, you built this company-wide program while you were at Booz Allen Hamilton. So I don't know how much you're allowed to share on it, obviously, and I assume you do, but how can you talk about how that came about? You know, talk a little bit about what you created there. Like how did you go down that path? How did you create this program and what did that look like and what did it do for Booz Allen?

Yeah. So for me, the way it started was it was an opportunity. I was rolling off of a couple other classified projects and was looking for a new permanent gig. That's how contracting works. And a former coworker who saw what I was doing worked in a close office when I was doing counterterrorism. I reached out to him, hey, do you know of any new gigs? And he said, yeah, actually I've got something. So he pulled me into Booz Allen Dark Labs is what it's called. They were working on creating a threat hunting training pipeline so that we, they could teach people how to threat hunt because it's not just something you pick up. There's a lot of training that's involved in it. And he knew that I didn't know network logs or detection analytics. I did people patterning and I knew Arabic, but, you know, Windows sim logs aren't written in Arabic. So he brought me in, fortunately, and I was a guinea pig, basically. I was the first one to graduate from this program. And while I was going through the program, I took every single course that they had started to lay out. I did some research. We found other courses. And I passed every single test, watched every single video that we decided that other folks would need to be able to understand the basics of Threat Hunt. I wanna say it probably took me 7 to 9 months with other projects on the side, obviously, to go through this training program that we established and then finalize it before we were able to offer it to other employees to sign up for this pipeline.

So you were the beta tester for the whole program?

Yes. Yes, I was. Like I said, I was the, the first graduate of the program.

That's awesome. That's very cool.

It was. Exactly. So obviously it worked for me. Following the program, I actually became the trainer for this Threat Hunt program to teach others how to write detection analytics. Which, like I said, was not my forte before. I picked it up from doing all of these different open source trainings, and I was training folks who already understood Windows logs. They knew what different events meant. They had engineering backgrounds, software engineering, and they asked a lot of questions that I didn't have the answers to because I only had— I had a very different experience. So, I would go to other more senior threat hunters and ask them to help me get the answers for these other trainees. And I learned a lot that way too. Um, but yeah, so that's basically where it started. And then from that program, and I started developing Windows detections in a tool that Booz Allen had built out that's now its own company. That's the platform that I was using to train folks. They actually have an open source community edition, so you can use them yourself to start learning and creating detection analytics. It's called SnapAttack, one word. Great group of folks, really cool tool, all kinds of threat intelligence in there. The blue teaming detections, the red teaming, like making your own proof of concepts and things like that in a little containerized environment. So really cool tool. That's what I use to teach other people how to do this. And then I also started writing classes. Cloud detection logs in there for AWS and GCP mostly. And from there is where I got picked up by the Sysdig Threat Research team to come in and start analyzing cloud detection logs and finding, figuring out what bad guys are doing by looking at the logs we were collecting as they were doing malicious activities. That's the transition I made. Do you have more questions about the actual threat hunt pipeline though?

Yeah, I mean, I'm a little curious. So you were the first one to go through this. Like you said, you were the guinea pig, which is really cool. And you said it took about 9 months, but that's, you had other projects going on the side too. So once, once you went through the program and you graduated, what did it look like going forward in terms of like how long did it take to go through if somebody was doing it full time, I assume? And how many students were you guys able to put through at a time? Like how quickly were you churning out, you know, trained threat hunters basically?

So I ended up leaving Booz Allen probably 7 months after I finished it. I want to say with the detection analytic portion specifically, I trained somewhere between like 40 and 70 people.

Oh, wow.

I can't remember exactly, but I'd have at least 1 or 2 group classes a month and train folks on how to use this tool and how to write basic detection analytics for Windows. Um, I'm not sure how many people graduated. I wanna say there was at least a small handful that were close to finishing when I left, but I don't know if they're still using it now or not. I did get great feedback from the folks that were in the pipeline while I was still active and teaching. Mm-hmm. Tons of information learned, really valuable resources. And like I said, they came from all walks of life. A lot of them too still had full-time jobs. So they were doing this training on the side, almost like, you know, going to school and getting another degree because they wanted to try something new. And they could then take this and become a CTI analyst or a threat hunter or incident responder, something like that. Get their foot into a SOC is what most of them were looking for, or just, you know, enhance skills, new, learn new things. So yeah, there was. All kinds of reasons why people were doing it, but very successful. Nothing but positive feedback from what I got.

How much of that, so when they're going through and they're doing this, they're picking up all these skills, how much of that then was being used or applied to protect like Booz Allen itself as the employer who was putting this together? Or were, were people then being put on contracts where they were going other places to protect other people? Or was this really just like OJT improving yourself and then people were leaving to go to other companies? Like, what was the benefit for Booz Allenham in all this?

I guess it was the two of the three, right? So people, as OJT people, are improving their skill sets, expanding their skill sets, that they are more valuable to Booz Allenham or other companies, right? Because they know how to do all these things. But really it was so that Booz Allenham had more folks trained, basic training as threat hunters, so that they could use them for their clients.

Got it.

Okay.

So they were monetizing it then, which is good. There's nothing wrong with that. Of course, Ooze was actually getting more talented people that they could then monetize on different contracts to do more work. That's cool. And that makes perfect sense.

That's— threat hunting is hard, right? And there's not a lot of people that do it. And then not a lot of organizations have threat hunters either. Like, it's kind of like a unicorn position. You don't see it that often, but it is starting to become more popular on, like, LinkedIn careers. So that's what they were just doing it to train these people so that they could offer them to clients. Because while we know you're not proactively hunting for threats, here's someone who can do it for you rather than having to hire and train your own. You just contract them out. So, yeah.

Yeah, it makes sense. Like you said, it's a growing field. I think I see more opportunities out there. You know, I think everybody's familiar with incident response, right? Bad thing happened. Now we got to go figure out what had happened and go run it back down. You know, as intel people, you know, we talk a lot about proactive, right? You want to do things as early as possible. The only thing in the world that's proactive is intel. You could argue, I guess threat hunting is too. I hadn't really thought of it. I keep saying intel is threat hunting is proactive in that you heard it someplace else. You're going to see if it's in your environment. I guess it's, you don't know if it's proactive unless you find something. I guess if you found something, it's reactive. If you don't find something, it's proactive, I suppose.

It goes from proactive to reactive at that point.

Yeah, exactly.

Yeah.

You don't know until you know, right? But it's intel driven and, and you go chase things down and, and like you said, there aren't a lot of people doing it and there still aren't, in my opinion, a lot of people doing it. I'm curious, it wasn't one of the questions we prepped for, but I'm curious on your thoughts on that. Is it, is it like Intel in that sometimes it's hard to convince people to spend the money on the resources to go chase things that aren't already on fire? You know, incident response, it's never hard to fund people for IR, you know, and, and some of the other monitoring systems, some of the things you have, but Intel always seems to be a little bit more challenging because it is proactive. So is, do we see the same thing with Threat Hunter? Are organizations having a hard time spending money for people that hopefully won't find anything.

Yeah, I absolutely think that's the case. It's hard to find intel positions too, because like you said, why are we funding something like that when, you know, I could just build my own RSS feed for free and look, there's all of my intelligence. Somebody else on the SOC can go through it. I don't need a dedicated intel analyst.

So if you think an RSS feed, obviously you don't, but for anybody listening, if you think an RSS feed is intelligence, It's not like I could go down a lot of paths and use a lot of curse words. Yeah, Twitter is also not. I could curse for days on the subject. It's insulting to an entire career field of people. That is data. That is information. That is a feed. That is not intel. We could go on and on about it. I know you know that. So yeah, it's, and I bristle because it happens a lot, as you know, like people do that. Like I got a bunch of feeds coming in. I don't need an intel analyst. You know, we see what's going on in the world. We're fine. And that's great right up until terrible things happen and they will. And I assure you, you know, organizations who tell me that, if they don't get off that side, I just wait around and see who the next CISO is. Like, that person's going to be fired eventually for terrible things, and the next person might be willing to invest in intelligence so it doesn't happen to them. Anyway, that's a sideline. I could, I'll get off my soapbox there. But what you're saying is it's similar with this, right? It's hard to get people to spend the money and the resources to chase things that haven't happened yet. How do you prioritize that? Even though it could save you a lot of time and money overall. If you find things early, or at least you know they're not there and you can, you know, protect, you can make the changes to the security protocols you need to change so the thing doesn't show up cuz you already know it's not in the environment. But those are always hard things it seems like to get people to, to justify the, the spending for.

Yeah. And I mean, threat hunting aside, there are other, and I think I've mentioned, we've mentioned all of these things already by name pretty much. There's other career paths that you can go and apply to and cept where you can threat hunt on the side because you have access to the logs and things like that, right? Threat research engineering, which is where I started here at Sysdig. Cyber threat intelligence. When you've got some downtime and you're not reading and collecting reports, go look through the logs and do your own proactive hunt. Same thing with detection engineers. You're writing detections for novel threats or vulnerabilities. Go and look through the logs and do your own threat hunt and see if it's there. Same with incident response. If you're not hair on fire responding to a current incident, then go and see if you can start a fire yourself. Go find a threat. But there's a lot of other things that you can do that could lend itself to threat hunt. So you can enhance this capability and, you know, put those sexy words on your resume that says that you were threat hunting somewhere. Getting in the SOC. I like SOC work. Socks are fun. That's where all the cool stuff is. Cool stuff happens in cyber.

Oh man, you haven't been, you haven't been in a bad SOC yet apparently, or you just haven't been burnt out by— I know a lot of people who do not think SOCs are fun or cool. They do at first, but over time it can wear on folks, but, but not for everybody. I mean, some people really love it for years and years. It is ever-changing.

It's where a lot of cool stuff happens.

Yeah, it is where a lot of cool stuff happens. I don't disagree. It's also where a lot of like stress happens, but, but no, it's true. There's a lot of cool things going on in security operation centers everywhere. All right. I mean, you've been a linguist, you've done intel analysis, you chased, you know, bad guys and then, you know, chased bad guys in cyber and then you went down this threat hunting path, right? And so where does that put you at this point? I think you're doing more cybersecurity strategy now. You know, how did all this benefit that for you?

I've had a plethora of experiences. I've done and seen a lot of things. And I have a very unique perspective of threats and a ridiculous passion for defense. I like chasing the bad guys and getting rid of them, however that may be, and protecting the good guys. You know, the greater good is not why I joined the military, but I mean, it all works out. That's just how I got to where I'm at. I enjoy telling people and trying to help them improve their defenses, being more proactive so these bad things don't happen, and then also making sure that they're faster in responding as well. I've been helping and pushing really hard within Sysdig to really amplify that defense is proactive and reactive, but when you're reactive, you have to be fast, you know, automating processes and having the right people in place and things like that. So that's kind of been my pet in the last year or so. And someone here just decided that, I don't know, I look good on camera and I kind of know what I'm talking about. So they have me talking to people and explaining these things to journalists because I wasn't an engineer, so I'm not super technical. So I understand these things at a level at which I can then explain them to other folks who aren't. Engineers or were engineers. So I have a really good ability to translate between the business and technical folk and distill what matters the most in cybersecurity. That's kind of where I'm at right now.

It's, yeah, well, and that's really important, right?

Not falling in my lap, but yeah.

But that's really important. I mean, the communication piece you mentioned, right? It's, listen, this isn't to slight anybody. Like everybody's got strengths and weaknesses. I know some super technical people who are also really good communicators. I don't know that many of them, if I'm being honest though. It tends to be that people who are heavily technical, they're just, that's where they live, right? And that's good. And it can be hard to translate that to simpler terms for people who aren't as heavily technical. And it doesn't benefit anybody if somebody spends 30 minutes lecturing on all sorts of very detailed, you know, technical components and algorithms and code and, and gets into the weeds on it, for people who don't understand what the hell they're talking about, right? It's, they come across as brilliant perhaps because we don't know any better either way, but they're not educating us in the process. The ability to translate technical into less technical terms, into more consumable terms is really important. You know, because without that, how are we gonna help people understand what is threat hunting? Why does it matter? You know, how do we, you know, get more people into this career field, whether it's through training or also through the funding portion of it. The engineers who are just great at the technical pieces aren't going to have those compelling, you know, messages necessarily. So it's great that, you know, we're in a position, you're in a position to do that, to have that discussion, that you've walked this path and you've been this pilgrim, for lack of a better word, I guess, across all these different career fields, right? To tie it together and say, this is what it is from Intel standpoint, and this is how it is to build these programs and why there's an importance in this career field, but in a way that, you know, dummies like me can consume essentially. You know, I'm glad you've gone down this path. There aren't a lot of people doing it, frankly. And it, and I think it's really important because again, find it or don't, like it's one way or the other. Things in your environment are there. If you find 'em early, maybe you can prevent things from getting worse, stop them. If you don't hunt for it and you just wait for incident response, I guess you could do that. But you know, if it were me, I would rather find a small fire in my kitchen with a, with my own fire extinguisher. And then wait until all the alarms go off and the fire department has to show up and half my house burnt to the ground.

Exactly.

That's just me, I guess, but probably not just me. I assume there's others. All right, so we talked a bit about the path and about the process and about the program, and I cheated a little bit. I got a little ahead because I have a third question we've talked a little about already, but I still want to review it and see what else you have on the topic, which is the program at Booz Allen, more about the successes of that program. And more importantly, really, do you think others could replicate the successes you had, or should they even try? Should companies be trying to build these programs in-house and, and teach their own people? You know, the topic was, can we make everybody a threat hunter, right? And in theory, if everybody in the company was and had that capability, maybe you'd have more people out there. The whole see something, say something concept of counter, you know, crime or terror, right? But is that— do you think that's possible? Should companies be trying to replicate the success you had? You know, are they capable of doing that?

I think they absolutely should if they have the capacity to be able to train larger groups of people to be threat hunters. I mean, I guess it makes more sense in contracting perspective where they can then share those assets, those people with their clientele, then that's great. But individual organizations, I think, should absolutely be looking for at least one person that has the capability to conduct this kind of work. But like I said, a lot of that training that I did though was open source, free, or I mean relatively inexpensive. It's something that everybody can access. So this isn't restricted. You can go and do some of these trainings on your own, improve your knowledge. And like I said, if you have the access, then start tinkering on your own and try to prove to yourself and, you know, prove to your organization that you can hunt. I actually had a friend that did that, was in threat intel and went on a hunt based on some intelligence that was reported a couple weeks prior and found a nation-state threat actor. So it does, and they went, no, not possible. Yeah, yeah, he was right. They were there. It happens. And, and you need somebody like that to be proactive and go look for it, cuz detections weren't firing, they were able to evade the detection analytics and lay low for who knows how long.

And you mentioned, uh, open source, right? A lot of this was open source tools you were saying. And I know specifically you mentioned Snap Attack, right? That was a tool that you said you wrote detections in. Let's talk about, well, I'll use me as an example. I'm probably the baseline. Like, I'm an intel guy. I don't know anything about threat hunting. I mean, I know the concept, right? But I don't do any threat hunting. I don't write code of any kind. Like, would I be able to— let's assume I'm moderately intelligent for the sake of this, 'cause you don't know better, but would I be able to pick this up? Like, do I have to have prerequisites? Do I have to already know how to write Python, for instance? Do I have to have any of that, or can I just walk in the Snap Attack and literally it would be easy enough for me to sit down and learn it? You know, how easy is this for anybody to pick up, or do I really need some prerequisites?

Well, first of all, you need to be the 1% of the 1% and have graduated from the Defense Language Institute. Successfully. Just—

I barely made that happen, but I'm in there.

Okay.

Yeah.

No. So yeah, sure, you could go into Snap Attack, you could go look at the detections that other people are writing and go start tinkering and playing. Like I said, there's— it's a purple teaming platform, so there's intelligence there. And then you take that intelligence and try to figure out how to put it together into detection, look at other people's and see how they're doing it, and then go to a sandbox and, you know, try to correlate that blue team, red team. Before that though, if you have no knowledge of any of this, what I would suggest is actually through MITRE ATT&CK, uh, MITRE Ingenuity is the name of their training that they offer. There's several classes. They are phenomenal about the MITRE ATT&CK framework, you know, attacker tactics and techniques. There's a lot in there about threat intelligence, about pen testing. Tons of valuable information there. I think it's like, it was like $500 or $600 for an annual pass to access all of those courses. Super valuable information that would definitely help you move into that detection engineering kind of thing. And then also I was, I mean, that was all kind of when I was at Booz Allen, and then I move over to Sysdig here and turns out Sysdig is the creator and maintainer of Falco, which is also open source detection. So they maintain it, but again, open source community. So you can go to falco.org and learn from— I mean, there's thousands of organizations that use Falco detection analytics to base their detection and response on for their companies. Security posture. It's CNCF graduated this year too. So it is stable and successful in production environments. So you can integrate Falco rules into your production environment for your organization. And there's, I wrote it down, over 115 million downloads of Falco right now. So there's lots of people using it and there's blogs and things like that that you can read about vulnerabilities, about writing detections. And it's all free and readily available for folks right now, which is amazing.

I'm going to hold you to it now. So we'll find out because I'm actually going to take a look at this, not while we're on right now, but I will afterwards. I'm going to look up Snack— Snap Attack. I'm going to look up Falco. And so I'm either going to be surprised. I'm going to be honest with you that it turns out it's something I could pick up and learn because, you know, if I can, I probably will. I could use some extra skill set. I think it'd be interesting to be able to poke around in the networks and do some hunting. Or I'm gonna ping you later and be like, nah, you left a piece out. I gotta be a little bit smarter than I am apparently, or I gotta know something first. The good news is MITRE Ingenuity is a really good resource. I know those guys well. I've worked with them before. Yeah. I had no idea it was that inexpensive, frankly. $500, $600 to access their entire library of training is pretty good. You know, just disclaimer, nobody here has any affiliation with MITRE Ingenuity. I'm not paid or anything like that, but I probably will go take a look at that as well and see, because that's actually a pretty good value. I'm gonna go check it out and I'm gonna, I'm gonna come back and and either tell you thanks, cuz it turns out I can do things I didn't realize I could, or I'm gonna tell you that now you owe me a bunch of training cuz I'm too dumb to do this on my own and now I wanna learn. So now I'm gonna force you to teach me.

I might have a lot of LinkedIn messages after this.

A lot of messages. A lot of messages. I'm gonna be hounding you. Listen, we don't live that far apart. I can drive to Wisconsin and I'll show up and, and, you know, force you to teach me how to do threat hunting cuz it is interesting stuff and, you know, there's a lot of value to it and there aren't enough people doing it. And you've convinced me that more people could be, and it would make us, you know, organization safer and probably would help a lot of us in careers for that matter. It's more flexibility and more opportunity, you know, in a career field right now in an industry that's contracting a little bit. So adding some skill set is never a bad thing. And threat hunting is an area where we don't have enough people from what I've seen, at least we don't have people doing it. Yeah, this is going to be my new hobby now. And, and I'll report back to you privately and maybe to the world eventually that either I'm Crystal's right and I actually was able to do this and anybody can, or it's not as easy as she said and you gotta be smarter than me, which still is most of the population anyway. So we'll, we'll see how that plays out.

We'll find out.

Yeah, we'll find out.

Follow along on LinkedIn and we'll—

listen, I'll be in Wisconsin. I'll hang out with your dogs and you can teach me how to do threat hunting if nothing else.

Perfekts.

Yeah, absolutely. All right, listen, this is really interesting stuff. So you've gone from linguist to intel. To, to dabbling and kind of being taught threat hunting and then teaching it and creating this program and, you know, and basically saying anybody can do this and we probably should have more people doing that, which I think is really interesting. You know, the original question was, you know, can anybody be a threat hunter, right? Can we teach anybody to be a threat hunter? And, and it sounds like your opinion is yes, if there's resources available, amazingly so many of 'em are open source, cheaply, we could be teaching more people to do this. And it sounds like from what you're saying, and I don't wanna speak for you, It would be better for everybody. It sounds like it'd be good for organizations to have more people. Now I'll ask you one little trick question on that, I guess. Like how dangerous it is though, if you have a lot more people doing this, let's say your whole CTI team got smart on threat hunting. Do we really want all these people poking around in our production environment looking for stuff all the time? Like how do you then keep the reins on some of these folks? So we don't have 40 smart people just running around the network trying to find things and possibly breaking a bunch of stuff. Like how do— Where do you think that's going to end up being a line that gets drawn?

I don't think there's anything they can break, man. I would say go for it. I would love to see that happen and just unleash a bunch of people to start digging through logs and see what they could come up with. I mean, especially imagining what sector the business is in or how large the organization is. I mean, you could probably come back with some nasty dirty laundry from some kind of a campaign like that, but it would be fun.

That's for sure. All right. All right. You, everybody heard that, like wherever you are, go open source, get trained and start just playing around in the logs and all your companies. And if anything bad happens, Crystal is the person to talk to. We'll make sure her contact info is available. No, I'm just kidding. Crystal's obviously not responsible for whatever foolishness people do on their own. No. But, but it is interesting. Yeah. You're saying you don't really think there's that much risk of breaking things, which is good. If anybody can, I'll figure out a way to do it. But, but I think it's very interesting. All right. Listen, as we're getting to the end of the show here, We gotta close out. We got the same question I ask everybody. The name of the show's Unspoken Security. Nobody gets a pass. You know, with that in mind, the question is, you know, tell me something you haven't told anybody before, something so far that has been unspoken.

So this goes back to, obviously, the coolest things I've done was when I was in the service. So we're gonna go back a little bit. My coolest career accomplishments that I don't really talk about. Include contributions to federal legislative actions against global illicit financial operations. So sanctions and things like that. And then also the arrest of— arrest, extradition, and sentencing of multiple transnational money launderers. So taking money away from bad guys.

Yeah, you are not popular with the criminal— not popular with the criminal element, it sound like then. Yeah, I'm not sure if that was the one I would have necessarily put out there publicly if I was you, but nobody listens to this show anyway, so it's not always gonna be targeting you. But yeah, it's— so that's actually really cool, right? I think people don't realize some of the cool things that get done all the time, really. I mean, it's a, you know— but you've got some that are better than most, right? Arrest, extradition, and sentencing of multiple transnational money launderers. That's a pretty, pretty good claim. And the federal legislative actions against illicit global finance networks, like, that's pretty impressive. Like, you, you've been knocking down money launderers and, you know, global illicit finance. Like, that stuff goes all over the place, right? So drugs and terrorism, you know, generally tend to be—

I told you I don't like bad guys.

So apparently, I'm guessing the bad guys don't like you. Yeah, I'm pretty sure the bad guys don't like you based on this. Like, this is, this is, that, it sounds like a feeling's going to be mutual. Like you're over there just smashing them and taking all their money away. That is not going to make you popular with the bad guys, but that's pretty cool. So that was in the military. What about in the private sector? Like I, I, what else you got for a big claim? Anything else?

So with Sysdig, we've identified multiple novel cybercriminal operations, several of them, which we have named operations, some fun names. We did identify one of the first targeted attacks against an LLM, which we called LLM jacking.

Oh God, not another term.

Malicious use and access. I know, but it sounds good and it makes sense. So stealing credentials to a cloud environment and then maliciously using the LLM resources and hiking up those LLMs are expensive for enterprises. $6,000 in one day. So it's a lot of money. Yikes.

That is a lot of money.

Yep.

Now, did you, if, if not here, I don't know if you've seen anyplace else yet, cause I'm just curious. This is totally off the wall, but have you seen attacks against LLMs themself, like trying to taint the data that goes into them and try to, this is something I'm curious about. I haven't talked too much about it with anybody yet, but I think that's what's coming, right? Is that people are going to become more and more dependent on AI and that's all really just these LLMs running underneath. And therefore, if I want to affect an organization's decision-making process, maybe I'll just poison the LLM that's the foundation for all their AI. Have you seen any of that yet? Was that part of this operation or, or not yet?

No, it was not. And you know what's funny is LLMs are new. They're openly available, right? Anybody can use them. So the first thing we said, all of us in cybersecurity and massive paranoia, they're going to mess with the data, which is possible, right? There's been studies and there's been proof. We have not identified any cyber criminals doing this yet. Like I said, they're more concerned with actually getting free access to decent models. They're not trying to poison data. Not yet anyway. But that's what everybody keeps saying. Right now they just want free access to it. That's not to say they won't do more with it. We have actually identified some use cases that we will be reporting. Reporting on in the next couple weeks. That's pretty exciting. So we have actually figured out what they're doing with this access to victim LLMs and more to come on that. But yeah, no, no data poisoning though, which is what we all assumed would be the biggest threat. Um, nothing yet.

Yeah, I still think it's funny.

The most data poisoning is probably from us all messing with it. It's not bad guys, it's people like us. That are just playing.

It's a good point. We're probably doing enough to screw it up that nobody else has to poison it yet.

Yep.

Yep. But it is interesting you mentioned the LLM jacking because yeah, they're just trying to get the free access. So it's sort of like when people were doing crypto mining, you know, crypto jacking, right? They get inside your network and they use your processing speed to do crypto mining because they're taking advantage of your computers and your energy, et cetera, and then pulling the crypto out. So now they're just doing it with LLMs where they're taking advantage again of your processing speed and your energy. But they're doing it to get access to AI for whatever nefarious purposes they're using it for.

It's interesting. We've seen this with a ton of services too. Yeah. Proxy services for VPNs. Same thing. Stealing access to proxies. And then what's the other one? Using, you know, free accounts, trial accounts that you get from like all kinds of different vendors and things like that. There was a, it was last year, I think we called it Purple Urchin. Funding. Oh God, massive crypto mining. They automated all of the processes and were using these free trial accounts, so then when they would run out of credits, they would automatically create another account and it just kept going and going. So really big, large-scale crypto mining attack that was almost completely hands-off.

So that makes sense.

They're always financially motivated.

Yeah, yeah. Well, it makes sense if you give somebody access to free accounts. It's a shame because they'll ruin it for everybody else. Free accounts are valuable and can help people get a foothold and an understanding of a technology or a platform. But there's always gonna be somebody out there who's gonna find a way to generate 1,000 free accounts and ramp up all the usage and then screw everybody else basically. I feel bad sometimes when I make 2 or 3 free accounts on something because I just need a little bit more, not enough that I really need to pay for it. I feel bad if I do that, but there's people out there with hundreds of these, thousands of these things. So it's interesting. It's good to have somebody who's looking for those things, right? And who's finding those things. All right, cool. So listen, we're pretty much running up on time here, but you know, I always like to make sure, you know, is there anything else that we've left out? Is there anything you want to add? Whether you want to talk more about, you know, Sysdig and what you guys are doing there, or you want to talk about anything else really, your kids, your dogs, you know, life in Wisconsin, you know, anything at all. Is there anything you left out you want to wrap up with before we call it a show?

No, I mean, now you all know where I live because I don't even think that's on my LinkedIn.

Uh-oh. Why did you give the town away?

Feel free to connect with me. I'm trying to build relationships with folks. That's how I actually met AJ. He was the guest on another podcast and my PR manager sent it to me and I listened to him and he was talking about his experience and I went, oh my God, it's like listening to myself talk. We have very similar backgrounds and that's why I'm here now. But happy to answer any questions, share any resources. We're all fighting the same fight and that's what I'm here for. So I'm all about helping. Just reach out if you need me.

Very cool. Yeah, it's definitely a team game. And I was thrilled when you guys reached out and when you reached out and I was like, oh, this is great. We should definitely have a conversation and see what's going on. Sorry to out you, but Wisconsin's a big state and I didn't tell them exactly where you live at least. So it'd be a little bit of hunting to find you still. And, and for those who don't know, it would not be that easy. And I don't recommend it cuz she has like 19 dogs running around that place. There's a ton of early warning system. I don't recommend going to visit Crystal, but I do recommend connecting on LinkedIn. She's, you know, obviously very bright and interesting and willing to help. It's always good to connect with people. As you said, it's, you know, it's a team game. We're all trying to fight the same fight and anything we can do to help each other out, you know, I think it's really valuable. Listen, with that in mind, that's going to be it. So I, again, I can't thank you enough for being on the show and taking some time to be with me. I know we're running up on time. Your kids are about to be home too, so we're going to actually beat the deadline there. But thanks again for coming on the show and spending some time here. And thanks for everybody who's been listening and watching. You know, please like and subscribe and tell your friends and neighbors, assuming you like the show. If you don't like the show, don't tell anybody anything, just shut up. But if you like it, tell people, you know, get more people involved. If you want to donate, that'd be great because I'm trying to keep this thing funded and running. But if not, that's cool. I'm going to keep it going somehow. So until next time, thanks everybody, and I really appreciate you listening and watching. It's been great having you here, and this is another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. Broken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.

Legends are made.