Session Description

In this lab session, IoCs for an APT and Ransomware attack will be introduced and tools used for threat

hunting will be leveraged to examine memory and a local partition. The practical exercises will teach you

how different IoCs can be professionally digested by threat hunting teams, and the various tools that are

used when threat hunting. This simulated APT and Ransomware attack will give you an insight into how

a threat hunting team investigates current cyber adversaries through the use of practical examples.

Session Objective

In this session attendees will learn how to work with IoCs and TTPs to investigate volatile data and

server endpoints. Learning which tools and how to use them to conduct scanning of endpoints and

systems will be become primary focus, in the process ensuring that attendees understand single IoCs

and conditional statements such as Yara. Various tools will be introduced for threat intelligence and

along with integrating it into network sensors and your threat hunting process.