WS4 - Pivot, Hunt, Publish: An Offline, Hands-On CTI Workshop for Blue Teams and Threat Researchers

for Blue Teams and Threat Researchers

Instructed by:  Rushikesh  Nandedkar

Level of Difficulty: Beginner, Intermediate

Abstract:

Cyber Threat Intelligence is the most overspecified and underspecified discipline in security. Every vendor sells a feed. Every conference has a track. Every blog post claims attribution. And yet - most blue teams still drown in IOCs they cannot operationalize, and most aspiring threat researchers do not know how to pivot from a single sample to a discovered campaign.

This workshop fixes both problems in four hours, fully offline, with every minute of those four hours spent on content rather than setup, and without distributing a single piece of malware.

Pre-Requisites:

·      Comfort on the Linux command line (basic file operations, running provided shell scripts inside the VM)

·      Familiarity with at least one query language: KQL, Splunk SPL, or OpenSearch DSL

·      Having read at least one threat intelligence report end-to-end (it does not matter which)

·      No prior CTI experience required; we explicitly start from foundations in Block 1.1

·      No external accounts required - the lab is fully self-contained

·      Completion of pre-workshop setup (see "Pre-Workshop Preparation section)

WHAT ATTENDEES MUST ARRIVE WITH (DAY-OF REQUIREMENTS)

·      The lab is set up entirely on the attendee's own laptop in the four weeks leading up to the workshop. On the day of the workshop, the attendee must arrive with:

·      The same laptop they used for pre-workshop setup

·      Administrator/sudo privileges enabled

·      The lab VM imported and bootable in the installed hypervisor (VirtualBox recommended)

·      30 GB free disk space (the VM is approximately 14 GB; we advise headroom for snapshots)

·      Minimum 16 GB RAM (8 GB will work but will be slow when OpenSearch and a browser are both running)

·      The pre-flight PASS token, generated within the 24 hours before the workshop, either printed or shown on screen

·      A note-taking tool of choice

Instructions will be sent to registered students when they sign up for the Workshop.

No external accounts, API keys, or vendor portals are required.

Nothing is installed at the venue.