Unlocking Insights: The Role of TI in Modern DFIR Operations
summary
Shows concrete DFIR+TI workflows that turn a few indicators into bigger breakouts: URLScan, VirusTotal and Malware Bazaar pivots attribute an Android sample to the Antidot/Sandiot family; a single Google dork links a compromise to prior Gallium/Gelsemium reporting and expands scope from one to multiple servers; passive DNS via Validin and URL scans tie C2 domains to phishing pages and typo‑squatted assets; crypto tracing with TronScan maps laundering chains. Each case finishes in under a day of focused TI work.
AI-written summary · about
chapters (8)
- 0:00Introduction and context
- 3:00Problem statement and mission
- 9:27Collaboration methodologies
- 12:15Success story: AntiDot trojan
- 18:02Success story: Gelsemium APT
- 22:17Success story: GodRAT malware
- 27:45Conclusion and takeaways
- 29:33Q&A and closing
related talks
30mTrawling for IOCs: Catching C2 in a Sea of Data
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
42mKeynote: The Expanding Universe of Cyber Threats
34mKeynote: Multiplying Threat Intelligence
31mDiamonds are a Forensicator's Best Friend - Intelligence Support for DFIR
31mAttack Hunting with Threat Intelligence
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful