ABSTRACT

The workshop will be based on a real-world attack scenario such as advanced persistent threats (APT) and hunting malicious artefacts efficiently. Get hands-on with the latest APT detections and threat investigations with MITRE TTPs that enriches blue team detection techniques. We will be using a threat hunting platform like Elastic including SIEM and machine learning in efficiently finding known unknown and unknown unknowns. We will also utilize the MITRE ATT&CK framework through-out the exercise.

• LAB 0: Familiarising yourself with the Lab Setup
• LAB 1: Analyse and Visualise with real time monitoring.
• LAB 2: Overview of Elastic SIEM
• LAB 3: Hunt the artifacts with MITRE TTPs.
• LAB 4: Using the Detection Engine
• LAB 5: Using Cases for collaborative incident response