Threat Hunting with LLM: From Discovering APT SAAIWC to Tracking APTs with AI

In December 2022, we captured the first sample of APT SAAIWC. LLM helped us swiftly identify other attack samples from APT SAAIWC among those submitted throughout the year. Following analysis of these samples, we were the first to disclose the organization's attack activities. The role played by LLM in this analysis amazed us, leading us to decide on its broader application across various stages of threat hunting. Besides uncovering details about APT SAAIWC, we will also share how we utilized LLM in filename-based threat hunting, automating sample hunting through YARA rules generated by LLM, and its broader application in threat intelligence and hunting. By: Hongfei Wang | Senior Security Researcher, DBAPPSecurity Co Ltd Dong Wu | Security Research Expert, DBAPPSecurity Co Ltd Yuan Gu | Senior Security Researcher, DBAPPSecurity Co Ltd Full Abstract Available: https://ift.tt/WtPah8G

source https://www.youtube.com/watch?v=YfTAWUvznFo