FIRST Workshop Series

March 25^th-April 22^nd, 13:00 UTC

View the Recordings on YouTube!

Program

All sessions are on UTC.

• Thursday, March 25^th

  Building a Successful Abuse Desk Registration

• Thursday, April 1^st

  AIL Framework

• Thursday, April 8^th

  MISP General Usage Training - Day 1

• Friday, April 9^th

  MISP General Usage Training - Day 2

• Thursday, April 15^th

  Build Your Own Malware Analysis Pipeline Using New Open Source Tools - Registration is Limited to 30

• Thursday, April 22^nd

  Using Sysmon to Improve your Incident Response and Threat Hunting Capabilities

About the Trainers

•  LU

  AIL Framework: Practical and Efficient Data-Mining of Suspicious Websites, Forums and Tor Hidden-Services

  Aurélien ThirionJean-Louis HuynenAlexandre Dulaunoy (CIRCL, LU), Aurélien Thirion (CIRCL, LU), Jean-Louis Huynen (CIRCL, LU)

  Alexandre Dulaunoy: Alexandre Dulaunoy leads the Luxembourgian Computer Security Incident Response Team (CSIRT) CIRCL in the research and operational fields. He enjoys working on projects that blend “free information,” innovation, and direct social improvement. When not gardening binary streams, he likes facing the reality of ecosystems while gardening plants or doing photography. He enjoys it when humans use machines in unexpected ways.

  Aurelien Thirion graduated from the University of Lorraine as a Master in Computer Science and Security. Aurelien is a software engineer and security researcher at CIRCL. He lead the development of the AIL framework and is a core member of the D4 project.

  Jean-Louis Huynen is a security researcher at CIRCL. He works on threat detection/intel and the development of tools to support incident response, Previously he collaborated with LIST-- Luxembourg Institute of Science and Technology (LU)--to the development of a Mixed Reality platform for the training for Security Critical Agents (mainly on firearms events and CBRN incidents). Previous research works (and his PhD) at SnT--Interdisciplinary Centre for Security, Reliability and Trust (LU)--focused on the usability of security systems and root cause analysis techniques for investigating security incidents.

  AIL[1] is an open source framework to analyse, correlate and crawl Tor hidden services, paste websites, forums or any facing services. The framework is used by many CSIRTs to find leaks of information, gather intelligence or suspicious activities at large. The module will present the functionality of the software and will include analysis on real information discovered during the training session. The objective for the participants is to gather experience in using and extending the AIL open source software to cover there use-cases. The workshop is also an opportunity to meet the core developer of the platform and propose direct changes in the open source software to support CSIRT community.

  [1] https://github.com/ail-project/ail-framework

  April 1, 2021 13:00-16:00

  ail-training.pdf

  MD5: 7fc688c3d4c1518fafa45802bf021955

  Format: application/pdf

  Last Update: April 6th, 2021

  Size: 2.7 Mb

•  PL

  Build Your Own Malware Analysis Pipeline Using New Open Source Tools

  Paweł SrokoszJarosław JedynakPaweł PawlińskiPaweł Srokosz (CERT.PL, PL), Jarosław Jedynak (CERT.PL / NASK, PL), Paweł Pawliński (CERT.PL / NASK, PL)

  Paweł Srokosz is a security researcher and a malware analyst at CERT.PL, constantly digging for fire and doing reverse engineering of ransomware and botnet malware. Free-time spends on playing CTFs as a p4 team member and studying for a PhD in Computer Science at Warsaw University of Technology.

  Jarosław Jedynak is a programmer that changed his career path to become a security engineer in CERT.PL. His speciality areas include malware reverse engineering, analysis automation in Python and administration of the ever-growing kubernetes cluster in CERT.PL. In his free he time plays security CTFs (with the p4 team he established 5 years ago) and browses cat memes on the internet.

  Paweł Pawliński is a principal specialist at CERT.PL. His past job experience includes data analysis, threat tracking and automation. In his current role, Paweł leads a team developing threat monitoring and data sharing systems.

  During almost a decade of our malware analysis experience in CERT.PL, we have tried many different approaches. Most of them failed but we have learned a lot about what works and what does not. Finally, after several years of development, we can publicly release a system that we are proud of: a complete open-source malware repository and analysis platform.

  The workshop will provide practical hands-on introduction to all aspects of the platform:

  • MWDB: Community-based online service for analysis and sharing of malware samples. The service is freely available to a white-hat researchers and provides fully-automated malware extraction and botnet tracking.
  • Malwarecage: Repository of samples and all kinds of technical information related to malware like configurations.
  • Karton: Microservice framework for highly scalable and fault-resistant malware analysis workflows. We will explain the installation and configuration quickly and spend the rest of time on adapting workflows to the Karton framework.
  • Malduck is our library for malware extraction and analysis. We'll explain how to use it effectively and how to create your own modules.

  All components are either already available on our Github page: https://github.com/CERT-Polska

  Registration for this workshop is limited to 30.

  April 15, 2021 13:00-17:00

  Build-Your-Own-Malware-Analysis-Pipeline-Using-New-Open-Source-Tools.pdf

  MD5: 1a9ca8fe24f4e3706328b2ca997fd937

  Format: application/pdf

  Last Update: April 22nd, 2021

  Size: 3.75 Mb

•  US

  Building a Successful Abuse Desk

  Severin Walker (M3AAWG, US)

  Severin Walker has over 15 years of experience in the areas of messaging security and incident response at Comcast. Mr. Walker has worked on several initiatives to better the customer experience as well as contribute to a more secure internet. His current team of engineers develop and maintain platforms that enforce best practices and protect their customers from attacks. At M3AAWG, Mr. Walker has presented on topics such as delivery over IPv6 and mailbox provider policies. He eventually went on to chair the M3AAWG Messaging and Technical committees, learning from the organization’s founding members while facilitating contributions from newer attendees. Mr. Walker believes M3AAWG to be an integral part of the internet's security as it provides a vetted and confidential space for hundreds of subject matter experts to collaborate.

  This training will focus on what the abuse desk team’s role will be, what to look for in team members, how incidents are generated and processed, and finally what the results of the Abuse Desk should look like.

  March 25, 2021 13:00-14:30

  Abuse-Desk-Training-Walker-Severin.pdf

  MD5: 729af37f3091ab88645c825b061fe20d

  Format: application/pdf

  Last Update: March 26th, 2021

  Size: 1.19 Mb
•  LU

  MISP General Usage Training

  Andras IklodyAlexandre DulaunoyAndras Iklody (CIRCL, LU), Alexandre Dulaunoy (CIRCL, LU)

  Andras Iklody works at the Luxembourgian Computer Security Incident Response Team (CSIRT) CIRCL as a software developer and has been developing the MISP core since early 2013. He is a firm believer that there are no problems that cannot be tackled by building the right tool.

  Alexandre Dulaunoy encountered his first computer in the eighties, and he disassembled it to know how the thing works. While pursuing his logical path towards information security and free software, he worked as senior security network consultant at different places (e.g. Ubizen, now Cybertrust). He co-founded a startup called Conostix, which specialised in information security management. For the past 6 years, he was the manager of global information security at SES, a leading international satellite operator. He is now working at CIRCL in the research and operational fields. He is also a lecturer in information security at Paul-Verlaine University in Metz and the University of Luxembourg. He is also the lead developer of various open source tools including cve-search and member of the MISP core team.

  MISP is an open source Threat Information Sharing Platform (TISP), aiming to provide a broad spectrum of sharing with machines and humans alike. CIRCL has been giving trainings on MISP and threat intelligence sharing in general as part of a continuous effort since 2016.

  The training is meant as an introductory workshop, tackling the main functionalities of the platform from both an analyst and as an administrator perspective, producing highly contextualized information, enriching it, collaborating on it and sharing it with partners and tools.

  This is the day 1 of a 2 day workshop.

  April 8, 2021 13:00-17:00

•  CA

  Using Sysmon to Improve your Incident Response and Threat Hunting Capabilities

  Peter Morin (Grant Thornton, CA)

  Peter leads Grant Thornton’s National Cybersecurity practice in Canada. He leverages over 25 years of experience to help clients develop robust Cybersecurity program strategies. This includes advising organizations in areas ranging from industrial and control system (ICS) security, network security architecture, threat hunting and red-teaming to cloud security, incident response, computer forensics and beyond. Throughout Peter’s career, he has held senior positions with numerous organizations, including a global Cybersecurity consulting firm, a national telecommunications and media company, a Fortune 500 cloud-computing company, a recognized Cybersecurity software company and a major US defense contractor. Peter holds several industry designations, including as a Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), Certified in the Governance of Enterprise IT (CGEIT), Certified Data Privacy Solutions Engineer (CDPSE) and a GIAC Certified Forensics Analyst (GCFA). As a public speaker, Peter has presented at numerous events held by the FBI, US Department of Homeland Security, Conference Board of Canada, FIRST, BSides, SecTor, SANS, Blackhat, Public Safety Canada, IIA and ISACA. Peter is also a frequent guest lecturer at colleges and universities across North America, and have been featured in such publications as SC Magazine, National Post and Penetration Testing Magazine.

  We are all familiar with Microsoft Windows style logging in the form of Event Logs (EV). How many of you have had to decipher an event log such as Event 4688 to come to find out that it lacks valuable details that could assist you in your threat hunting, security monitoring or incident response activities. In many cases, event logs may be the back-bone of your security logging capabilities if you are in a restrictive environment such as an industrial control system (ICS) setting. There is a valuable alternative to simply relying on event logs. This presentation will introduce attendees to the free Sysinternals tool, Sysmon. Are you an incident responder? SOC analyst? Does your job require you to work with Windows event logs? Do you need to reconstruct attacker timelines? Sysmon is an invaluable tool and a must-have in a Windows environment. During this workshop we will discuss implementation techniques, use cases, and integration with other security tools through demonstrations.

  April 22, 2021 13:00-17:00

Registration Has Ended