Sebastian Möbius, Consulting Director Proactive Services Unit 42 at Palo Alto Networks

Incident Stories from the trenches and lessons learned
As many IR companies we experience Incidents on a daily basis. Some of these cases were different from others, as it always is.

We want to use that opportunity to share some of the stories and insights we gained. But mostly we want to focus on the lessons learned and maybe help to increase the options available to you.

 Some topics we will cover:
- Detection Use Cases and Options to monitor if the EDR is tampered with!
- Out Of Office hours! Every Ransomware case we had showed that behavior.
- Canary Token to monitor if admin accounts are tempered with.
- Remote Tools leveraged as "legit" BackDoor
- How to hunt an actor through an enterprise? Especially without Cloud Connection and Firewalls etc.

Alain Mowat, Head of Research and Development at SCRT

Purple teaming our way to SOC efficiency
Most companies have now implemented some kind of Security Operations Center whose role is to detect and respond to security incidents. They often leverage Endpoint Detection & Response telemetry for this task. Despite these tools and processes, we have performed many pentesting engagements where the SOC was either unable to detect the attacks we take out or responded too late to have any kind of impact. This has also been shown in certain real-life incident response scenarios, where despite having one or even multiple EDR solutions, clients have had their information systems fully encrypted.

This is generally due to the following issues:

• Current attacks rarely exploit vulnerabilities but tend to target insecure (often default) configurations, typically in Windows and Active Directory. This is a lot harder to detect than a malicious executable file communicating with a C2.
• Even if there is some telemetry returned for the attacks, the defense teams are unable to respond due to not knowing what the attacks are of even how to properly use the tools at their disposal.

Purple team exercises come in to improve these aspects by having one or several red team operators work with the blue team by simulating the latest attacks to ensure that the SOC receives the appropriate information and telemetry to detect them and respond appropriately. This helps the blue team recognize and prioritize important alerts as well as generally improve the security posture of the company by updating the insecure configurations.

Lee Mössner, experienced CISO & Cybersecurity Expert

The OpenCanary Experience
A personal research project running honeypots in the Internet with some obvious and some not-so-obvious discoveries...
In an increasingly connected world, cybersecurity is paramount. This personal project explores the deployment and utilization of OpenCanary, an open-source honeypot framework, on the Internet. OpenCanary serves as a digital decoy, emulating vulnerable services and capturing potential threats, providing valuable insights into emerging cyber threats and attacker techniques.

This project not only serves as an educational endeavour but also as a practical approach to bolstering cybersecurity defences. By running OpenCanary on the Internet, we aim to gain a deeper understanding of the digital threatscape and implement proactive measures to safeguard against potential risks.

The project also discovered some unexpected consequences of having certain ports and protocols open to the Internet and the OpenCanary developers have also accepted some feature requests to further improve how OpenCanary can support security researchers.

Roundtable 1: Sebastian Möbius, Consulting Director Proactive Services Unit 42 at Palo Alto Networks

(Details will follow)


Roundtable 2: Anderson Dedario, Founder of DevOps.Security

Threat Modeling: From Basics to Actionable Insights
This roundtable delves into the core of threat modeling, covering its essential concepts and highlighting its importance. We'll discuss the practical steps for its effective implementation. Through shared experiences and best practices, participants will not only gain a deeper understanding but will also leave with actionable insights that can be directly applied to bolster their security strategies.


Roundtable 3: Fabian Gasser, Head of Cyber Advisory at Ontinue

Detection & Response Engineering: Toward modern practices for effective SecOps
(details will follow)


Roundtable 4: Konstantinos Giakoumelos, IT Security Operations Senior Analyst at Amcor

Unmasking the Cyber Security Chessboard: Who Holds the Upper Hand? Defenders vs Attackers
In this roundtable, we will delve into the ongoing race faced by SOC (Security Operations Center) professionals, as well as security experts in a broader context, to outpace potential attackers. Are we maintaining a lead over them? How can we equip ourselves for their next move? What are the numerous obstacles in winning this race, and what kind of commitment is required both individually and collectively as a group or community?