• Connect to Us

Ahmed Techini


An IT security engineer with a master degree and different industry certifications (Cisco, CEH, CISSP). Ahmed is a passionate about cyber security, vulnerability assessment and penetration testing. He is sharing his knowledge by teaching a cyber security lecture at École Polytechnique of Montreal.

All Sessions by Ahmed Techini

  • Day 1


  • 16:15  - 17:00
    I was implementing JA3 (open source from salesforce) for a complex environment to show the value of TLS fingerprinting for network security detection. My approach is hybrid since I was mixing data from network (using open source Bro) and data collected from host (A commercial EDR) to map every JA3 to a process name. My end game is to create a whitelist of JA3 (mainly baseline the use of TLS in our environment) that could be help security monitoring to detect new TTPs as Domain fronting. I already presented some of my research internally and It is the first time to present it outside.
    ATT&CK
    Bro/Zeek
    Incident Response
    Threat Hunting
    Where
    Speakers Hall




Share

Ahmed Techini