Threat Hunt Trilogy: A Beast in the Shadow

In this presentation at the DEF CON 30 Blue Team Village, cybersecurity researcher Meisam Eslahi presents "Threat Hunt Trilogy: A Beast in the Shadow," detailing a disciplined forensic methodology for identifying hidden adversaries within compromised enterprise networks. He opens at 09:00 by detailing the continuous threat hunting loop, stressing that analysts must systematically review, improve, document, and update detection logic with each investigation.

Meisam explores detecting destructive malware at 18:00, explaining how anomalous mass-file modification behavior serves as a high-fidelity indicator of active ransomware or disk-wiping payloads. At 27:00, he demonstrates live host triage techniques, examining running process hierarchies, active file descriptors, and open network sockets to detect anomalous execution trees.

Transitioning to deep memory forensics at 36:00, Meisam showcases using Volatility 3 plugins like netscan to uncover covert command-and-control network sockets hidden from traditional OS diagnostic tools. He correlates these findings with network traffic captures at 45:00, analyzing malicious HTTP beacon intervals to expose stealthy adversary communication channels. He concludes at 54:00 with recommendations for translating hunt findings into durable SIEM correlation rules. (AI summary — Gemini Flash)