Whodunnit - Threat Hunting with Dissect and Volatility
āšROOM 3.1
āThis workshop immerses you in the practical world of digital forensics. Together, we will look into a security incident to reconstruct the attack vector that led to the system being compromised. The tools that are gonna come in handy for us will be Dissect and Volatility for disk and memory analysis.
By the end of the session, you will know how to parse a compromised image for evidence, identify malicious scripts and trace the adversary's footprints.
This workshop is accessible to all skill levels. No prior experience with the tools is required, just a bit of Linux and Python know-how! For the rest, we've got you covered with the hints and documentation needed.
The materials for this workshop were developed as the activity of SOCcare project (Grant Agreement No. 101145843). Project partners: NRD Cyber Security and RevelSI. Funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or European Commission-EU. Neither the European Union nor the granting authority can be held responsible for them. The project is supported by the European Cybersecurity Competence Centre (ECCC).