Welcome to Pluralsight and this Blue Team Tools course featuring HELK,
the open source OS data analysis tool developed and
maintained by Roberto Rodriguez, who goes by the moniker of Cyb3rWard0g.
Common detection capabilities are constantly evaded by
sufficiently advanced adversaries.
To detect the undetected, you, as the security analyst,
have to morph into a threat hunter.
HELK is engaged on networks to do just that.
Collecting Windows logs, including Sysmon,
from as many sources as possible, those logs are thoughtfully parsed,
and you, the threat hunter,
use Jupyter Notebook to invoke Apache Spark and GraphFrames to query
for curious connections or relationships between the data that could
indicate yet undetected malicious behavior.
The extremely well‑crafted Kibana dashboards take it from there,
illuminating related attacker techniques with ease.
The toolset included in HELK is adept at unearthing a
variety of Windows endpoint attacks.
In this course, you will track down activity relating to Kerberoasting,
BITSADMIN data transfers,
and the clearing of Windows logs by attackers attempting to remain stealthy.
HELK, known as the Hunt ELK,
is built from the ground up for Elastic Stack‑powered threat hunting,
and with the modified prey turned predator logo to match,
leveraging Elasticsearch, Logstash,
and Kibana to provide not just an interface for Windows log analysis,
but also a base upon which capabilities for machine learning and enhanced
analysis with tools like Apache Spark and GraphFrames can operate.
Come join me in learning to harness the power of HELK to
discover undetected advanced adversaries,
operating in an enterprise environment, much like your own.