Track 3 Saturday·54 min
Robert Moody · Robin Williams
Shows how intelligence-led purple team exercises turn adversary TTPs into scenarios for testing and hardening security controls.
intelligencethreatdetection+3
Track 3 Saturday CC10
Mesa, AZ, USA · February 2022 · 7 talks
Track 3 Saturday talks from CactusCon 10 2022.
1–7 of 7 talks
Track 3 Saturday·52 min
Allan Liska
Lays out how organizations can prepare for a ransomware attack and handle the first stages of response, from logging to recovery and testing.
ransomwareincident-responsesecurity-operations+1
Track 3 Saturday·37 min
Mark Embrich
Walks through a VBScript dropper that randomizes array decoding to produce many different file hashes for one payload.
malware-analysisransomwarewindows+2
Track 3 Saturday·31 min
Bryce Webster-Jacobsen
Explains how human negotiators and dark web intelligence complement automated tools when responding to ransomware incidents.
ransomwareintelligenceincident-response+2
Track 3 Saturday·46 min
Rami Al-Talhi
Shows how Wireshark plus JA3, JARM and SSH fingerprints can expose APT activity hidden in encrypted packet captures.
networkincident-responsethreat-detection+1
Track 3 Saturday·41 min
Oleg Skulkin
Walks through LockBit ransomware affiliate tactics, from initial access and credential theft to data theft and encryption.
ransomwareincident-responsethreat+2
Track 3 Saturday·43 min
Ross Burke
Shows how to triage large packet captures from the command line using TShark and the PacketSifter script.
networksecurity-operationsincident-response+2