DFIR 212

Welcome Coffee

Opening Speech of Mr. President of the National Commission for the Control of Personal Data Protection (CNDP)

French

Opening Keynote: Tales Of The Future Past

English - No recording

In ‘Tales of the Future Past’, Saâd Kadhi, the Director of CERT-EU, invites you to embark on a time-travelling odyssey.
The journey commences with a retrospective dive into the past, where attendees will glean insights from CERT-EU’s unique vantage point on the threat landscape, hovering over noteworthy developments the Cybersecurity Service for the Union entities had been observing.
As the time machine propels us into the future, the presentation demystifies the complexities of Artificial Intelligence, shedding light on AI’s burgeoning role in cyber threats. It offers foresight and thoughtful projections on potential AI-powered dangers, equipping the audience with the knowledge to anticipate and navigate future challenges.
The expedition culminates with a return to the present where Saâd will share his ideas on how to fortify our defences against the cyber threats of today and tomorrow.
Designed for a diverse audience, ‘Tales of the Future Past’ promises to be an enlightening journey, offering a unique blend of historical wisdom, futuristic insights, and practical, present-day solutions.

EUREKHA: Enhancing User Representation for Key Hacker Identification in Underground Forums

French

Abdoul Nasser will unveil EUREKHA, an innovative approach for identifying key hackers in underground forums. By modeling users as textual sequences and leveraging Large Language Models and Graph Neural Networks, this method achieves remarkable improvements in accuracy (+6%) and F1-score (+10%) over existing techniques. Backed by the Hack-Forums dataset, the talk promises actionable insights for anyone interested in cyber threat intelligence and network analysis. Bonus: the code will be open-source!

Boosting your Threat Hunting with LLMs

English - No recording

In this presentation, we explore practical approaches to get started with Large Language Models and use them to supercharge your threat hunting.
The goal is to leverage LLMs to improve your workflow of deriving insights on prevention, detection, and response from threat intelligence.
This talk provides a primer on LLMs and GenAI and offers value to both technical and non-technical attendees, equipping them with the knowledge to delve into this emerging field and encourage meaningful conversations.

Design, and implementation of a detection tool for temporal anti-forensic techniques: Backdating and Timestomping

French

This research and development project aimed to enhance the technical capabilities of the CSIRT team by developing a tool to detect temporal anti-forensic techniques, specifically “backdating” and “timestomping”. The primary challenge addressed in this project was the need for advanced technical tools to support CSIRT’s incident response efforts. Incident response teams regularly face multiple challenges at every stage of the response process. In this context, the project focused on the feasibility study, design, and implementation of a tool to identify temporal anti-forensic methods used by malicious actors to hide their activity, such as altering timestamps on system events and files. Currently, the CSIRT team is working on various projects to counter anti-forensic tactics, with a specific focus on detecting timestamp manipulations. This tool will enable post-event detection of system clock alterations and file timestamp modifications within the filesystem. These anti-forensic techniques are often employed by attackers to hide their presence. After detecting “timestomping” (file timestamp alteration) and system clock tampering (“backdating”), the project also aims to restore a coherent event timeline to provide analysts with improved visibility into actual events.

Free Break

Disguised Dumplings: Turla's Pelmeni wrapping Kazuar

English

Over the past 25 years, Turla has positioned itself as one of the more sophisticated and persistent state sponsored groups. This technical talk will start with a brief history overview of this group, followed by details of a new campaign (starting Q1 2024) of Turla called Pelmeni. The Pelmeni campaign consists of two distinct components, each revealing the group's advanced tactics and persistence. Throughout the talk, we will explore the discovered samples, strategies of pivoting, insights from reverse engineering efforts, and other pertinent aspects of this campaign. By examining these elements, we aim to gain a deeper understanding of Turla's evolving methodologies and their implications for cybersecurity.

Crypted Hearts: Exposing The HeartCrypt Operation

English - No recording

In June 2024, Unit 42 began tracking HeartCrypt, a Packer-as-a-Service sold on forums and Telegram. Over 2,000 malware samples packed with HeartCrypt have been identified, spanning 45+ malware families, including Remcos, LummaStealer, and tools linked to ransomware affiliates like BlackSuit and Hive. This talk delves into HeartCrypt's evasion techniques, obfuscation, and development timeline, highlighting its role in recent LummaStealer Fake Captcha campaigns. We'll analyze the threat actor behind HeartCrypt, focusing on sales channels and underground forums, and offer insights into this rapidly evolving malware distribution ecosystem.

From Known Threat Detection to Unknown: Advanced Cybersecurity with Zero-Trust

French

In today's increasingly connected and digital world, cybersecurity systems primarily rely on known threat indicators for detecting attacks. Traditional methodologies, such as antivirus signatures, heuristic algorithms, sandboxing behaviors, Indicators of Compromise (IoCs), YARA and Sigma rules, Living Off The Land Binaries and Scripts (LOLBAS), and tactics, techniques, and procedures (TTPs) from MITRE ATT&CK, all focus on recognizing malicious patterns based on historical data. However, these defense mechanisms face an endless battle against an ever-expanding universe of malicious artifacts. These traditional approaches falter when faced with unknown threats such as Zero-Day exploits. The inability to predict these threats poses a profound weakness to current cybersecurity solutions and technologies, leaving them vulnerable to unseen malicious behaviors. This calls for a paradigm shift in our approach to cybersecurity: the implementation of Zero-Trust principles. Originating from the belief that no user or system should be trusted by default, Zero-Trust operates on a 'never trust, always verify' basis. Utilizing Zero-Trust as a proactive defense mechanism can help detect unknown threats. Rather than focusing on a potentially infinite list of malicious elements, Zero-Trust narrows the focus to verifying and allowing known legitimate behaviors and programs. This concept is akin to defining the permissible actions of an application installed on a smartphone. By deploying Zero-Trust, we can create a more secure ecosystem, ensuring strategic and pragmatic security today while paving the way for the future of cybersecurity.

Coffee Break

TSURUGI Linux - The Sharpest Weapon In Your DFIR Arsenal

French - No recording

Any DFIR analyst knows that everyday in many companies, it doesn't matter the size, it's not easy to perform forensics investigations often due to lack of internal information (like mastery all IT architecture, have the logs or the right one...) and ready to use DFIR tools.
As DFIR professionals we have faced these problems many times and so we decided last year to create something that can help who will need the right tool in the "wrong time" (during a security incident).
And the answer is the Tsurugi Linux project that, of course, can be used also for educational purposes.

How To Detect A Red Team Operation (With A Cat)

French

Join us for an in-depth exploration of advanced Red Team strategies !
We'll dive into the Cyber Kill Chain, from crafting stealthy droppers to leveraging redirection tactics and bypassing EDR protections.
Watch live demos on phishing techniques, unconventional persistence and privilege escalation in action.
In the post-exploitation phase, learn how to perform a DCSync undetected attack or inject a hook into the Azure AD authentication processes.
This session is packed with actionable insights for Red Teamers eager to refine their techniques.

Ransomware, Insider Threats, & Malware Infiltration In The Digital Era

English - No recording

The topic highlights the evolving tactics of cybercriminals, focusing on insider threats, ransomware, and malware spread through malicious downloads.
Using recent statistics, real-world case studies, and visual data on cyberattacks across Africa and Morocco to reveal the growing risks impact on critical sectors.

Awareness about phishing campaigns with GoPhish

French

This session will raise awareness about phishing campaigns and demonstrate the step-by-step implementation of a phishing attack targeting PayPal using GoPhish. Get ready to dive into the techniques and tools attackers use—and learn how to defend against them!

Event Closure