1. Detection through Elastic Security SIEM, deployed in a shared VM, including installation guidance and explanation of key security detection policies.
2. Retrieval of malware artifacts and TTPs for analysis, including: a. Introduction to static analysis and required tools. b. Dynamic analysis techniques. c. Brief introduction to reverse engineering, required tools, basics of Windows architecture, and portable executable structure to help participants enter the reverse engineering field.
3. Thinking outside the box for external malware hunting to feed SIEM or SOAR systems, using various techniques. 4. Revealing a technique to identify malware types and adapt to their base architecture to find security vulnerabilities or misconfigurations for exploitation.

We will cover as a Training two strategies:

explaining a real-world use case scenario of identifying and detecting a Malware Loader infection, and providing a live demonstration Explaining the detection process, followed by the required elements and techniques for investigation:

USE CASE Scenario:

-Identifying behavior through SIEM

Malware Analysis 101:

-Static analysis

-Dynamic analysis

-Automated analysis

REVERSE ENGINEERING 101:

-Anatomy of a Windows PE Compilation

-x86 assembly language

-Typical attack track

Threat Hunting Introduction:

-Proactive approach

-Setting up a war zone area (Tools)

-Local hunting and red flags

-External hunting

-Hunting C2 malware

-Hacking back Command & Control

Estimated Duration: 2 hours