Additional Programming

This course will take place from 10:45-12:30.

Course Level: Intermediate

Intended Audience: Security/SOC analysts, CSIRT/CERT team members, Forensics investigators

Pre-requisites:
Download all course materials, follow documentation to prepare laptop for the labs (coming soon).

Hardware requirements:

• OS: Windows 7 or greater
• CPU: The faster the better, but the software will work OK with CPUs dating back to the first Intel Core-i line.
• Memory: No less than 4GB, but the more the better.
• HDD: recommend having at least 80GB free disk space. SSD recommended but not required.

Abstract:
Two of Microsoft Security Response Center’s digital forensics experts will lead you through a deeper understanding of Windows forensic artifacts, how to analyze them, and how to fit them into your greater understanding of an investigation. Examples include the master file table, the Windows registry, and Windows Event logs. You will use your newfound understanding of these artifacts to perform analysis of disk images and come to conclusions based on various real-world scenarios the instructors have encountered while working within the MSRC. You must bring your own laptop.
Lab materials will be provided ahead of the event.

Topics: -Introduction -Scenario Exploration -Use of the tooling -Analysis of artifacts Event logs Application logs Registry NTFS File System (Master File Table) Recycle Bin & Deleted Files Other sources of file and application execution evidence Services and Tasks Remote control analysis Volatile Data: Process and Network Artifacts Windows 10-specific artifacts, including Cortana, Edge, and Notification Center -Timelining the evidence and fitting it into a larger investigation

Course Level: Beginner to Intermediate

Intended Audience: Malware analysts and researchers

Pre-requisites:
Download all course materials, follow documentation to prepare laptop for the labs (coming soon).

Hardware requirements:

-OS: Windows 7 or greater -CPU: The faster the better, but the software will work OK with CPUs dating back to the first Intel Core-i line. -Memory: No less than 8GB, but the more the better. -HDD: recommend having at least 80GB free disk space. SSD recommended but not required. -Hands-on exercises will involve operating with malicious code! -The laptop needs to have an installed VMware Virtualization or Hyper-V Virtualization, with a Windows 7 or above operating system installed, as guest OS. -You need to be able to make snapshots of the guest OS and transfer file between host and guest system. Also the guest OS should have no Antivirus software installed and you need to have admin rights.

Abstract:
Learn the fundamentals of malware reverse engineering. While malware grows exponentially the techniques malware exhibits are often similar. The class focuses on outlining these commonalities and how to use IDA Pro and dynamic analysis to deal with them.

Topics:

• Introduction
• Getting started with malware analysis
  • Triage
  • Common malware modularization & behaviors
  • Common anti-analysis & anti-AV tricks
• Static Analysis With Ida Pro:
  • Ida Pro basics
  • Recognizing programming constructs
  • Rebuild high level constructs (structs, enums)
• Dynamic Analysis
  • Debugger basics
  • Manual unpacking & dumping position independent code
  • Patching to change the behavior in favor of the analyst

Course Level: Beginner

Intended Audience: Security/SOC analysts, CSIRT/CERT team members

Pre-requisites: See attached document.

Abstract:
The goal of the tutorial is to familiarize participants with Incident Response and Cyber Threat Intelligence using TheHive, a Security Incident Response Platform, Cortex, a powerful observable analysis engine and MISP, a popular threat sharing platform. All software is free and open source.

Topics:

• TheHive, Cortex & MISP Overview,
• Installing & configuring the product stack
• Bringing it all together
• An IR case study
• Dealing with notifications
• How CTI feeds IR
• How IR feeds CTI
• The CTI-IR cycle: case study

This course will take place after lunch from 13:45-15:30.

Course Level: Advanced

MITRE’s freely-available ATT&CK™ framework is being widely adopted by both producers and consumers of cyber threat intelligence as a common “language” to describe adversary behavior. Come get an update on new developments in ATT&CK, and discuss how you use ATT&CK and how you’d like to see it evolve in the future. Attendees should have basic familiarity with ATT&CK. For those who don’t, here is a very brief overviewhttps://www.youtube.com/watch?v=0BEf6s1iu5g&t=1s of ATT&CK.

Google has a long history of developing security technology that benefits not just our own users, but the online world as a whole. When we create technology to keep our services safer, we find opportunities to share it for everyone’s benefit. And as threats change over time, our adaptive, forward-looking measures pave the way for other companies to follow.

In order to further our commit to help make the Internet a safer place, we would like to take this time to talk openly with CERT teams on how we can improve cooperation and information sharing in the future.

Recent developments in the regulatory environment of some CIRTs (i.e. GDPR), the emergence of cyber insurance, and the need to collect more and better metrics about incidents continue to raise questions and concerns within the incident handling community. Emerging technologies can help address these issues, but first need to be properly assessed. This BoF session will propose a different way of approaching these issues to make progress: a slow-pace, long-running cyber exercise that generates realistic use cases for further analysis and discussion. Running remotely over several months but requiring only a few minutes of work per day/week, it is hoped that such an exercise can help assess the potential value of new technologies in the incident handling process and generate useful simulation data to support ongoing debates and discussions.

Since 25th of May, GDPR is in place and after one month we have already observed some affects on our community. Within this BoF we would like to discuss the impact of GDPR and evaluate what the community may need to address. The outcome might be a SIG which is addressing the discussed topics.

Attendees should be people interested in the topic of privacy and especially GDPR. The BoF will not give an overview of the regulation, as so people should be familiar with the regulation.

Please note this meeting will follow the AGM.

The main topics of the BoF will pass though leveling the playing field and taking the opportunity away from the Treat actor. Attendees should expect to discuss searching for a community agreement on "What Treat Intelligence is today" and working towards taxonomy.

Interested in FIRST membership and have questions about the application process or benefits of joining? Join us for this session to learn more about membership and ask your questions! Please note - we encourage you to enjoy a 30 min lunch from 12:30-13:00 before joining the meeting - or make a plate and bring it with you!

Continuing from our inaugural BoF at FIRST 2017, we welcome everyone who is interested in developing taxonomies and ontologies in IR and TI for a discussion of how best to achieve interoperability through the use of taxonomies and ontologies of data and resources. There has been an uptick in the interest in making data more actionable by using such classification schemes in IR, but nothing has been widely accepted. The best ontologies are created as a group effort and not in a vacuum, so we wish to bring together everyone who is interested in the subject to discuss how we can reach our goals. If the participants request it, Morton Swimmer can demonstrate ontology design and editing using Protégé, a free tool available from Stanford University. Related events to this BoF at FIRST 2018: https://first.org/conference/2018/program#psemi-automated-cyber-threat-inte lligence-act

https://first.org/conference/2018/program#pmanaging-risks-through-taxonomie s

https://first.org/conference/2018/program#premoving-the-pain-from-the-repet itive-processing-of-vulnerability-reports-using-a-vulnerability-ontology

https://first.org/conference/2018/program#pstix2-taxii2-workshop

https://first.org/conference/2018/program#pwhy-is-cti-automation-harder-tha n-it-needs-to-be-and-what-can-security-teams-do-about-it

Out of 20K publicly disclosed vulnerabilities in a year, how many are used to attack you? How do you decide which vulnerabilities get your attention? Let scan and patch decide? How do they decide? Does the decision involve CVSS? Join this BoF to talk about what defenders and vendors really want in terms of prioritizing vulnerability response.