ATT&CK isn't just for Windows! @ForensicITGuy from @redcanaryco will be sharing "Alertable Techniques for Linux using ATT&CK" to discuss that not every technique is alertable and not all of them provide the same value for immediate detection. #ATTACKcon
@ForensicITGuy @redcanaryco Tony's getting into some specific technique implementations in Linux, a Platform where ATT&CK could certainly use more information on. Getting into how we can respond to alerts quickly, and what they might be telling us. #ATTACKcon 
@ForensicITGuy @redcanaryco “Most of the time a curl command going to Pastebin is going to be malicious. If that’s in your business model let me know.” Some great tips on what to alert on in Linux. #ATTACKcon
@ForensicITGuy @redcanaryco And now some tips on what not to alert on in Linux. “Anything discovery is going to suck” talking about how many discovery commands are common, or aren't going to make it off the system. #ATTACKcon
