2024 FIRST Cyber Threat Intelligence Conference
2024-04-15..2024-04-17
Berlin, Germany
who it's for
cyber threat intelligence analysts, cti managers, threat hunters, incident responders, security engineers, malware analysts
topics
STIX 2.1 extension and mapping; OpenCTI large-scale ingestion; attack trees with MITRE ATT&CK; automated CVE scoring pipelines; image and Office artifact tracking; vector search with TLSH; priority intelligence requirements (PIRs) rollout; CTI maturity model controls; processing threat reports at scale (spaCy, XGBoost); private search set for safe sharing; infrastructure profiling with JARM and Shodan; LLM and vector RAG for CTI
| title | author | length |
|---|---|---|
| Solving CTI Sector Incoherence in a Living Growing OpenCTI Repository: Extend STIX 2.1 FTW | Philippe Lin | 22m |
Company OpenCTI instance accumulates 7 million entities and 10 million relationships from 50,000 external reports ingested over three years by 50+ researchers… | ||
| Advanced Cyber Threat Intelligence Chapter - How to Read the Mind of your Attackers | Erick Thek, Vladimir Kropotov | 21m |
Level 3 CTI maturity means producing actionable, evidence‑backed assessments not generic themes and the talk shows how to get there: ingest and automate… | ||
| Tracking Threat Actors Using Images: A Hunting & Analysis Approach | Joseliyo Sánchez | 30m |
Claim: images and Office artifacts let analysts pivot and track campaigns across years. Using VirusTotal exports and parsing content-types.xml and styles.xml… | ||
| Automating Cyber Threat Intelligence: A Practical Approach to Managing Emerging Vulnerabilities | Andy Giron, Fred Baguelin | 25m |
Datadog threat team describes an automated pipeline that scores CVEs by GitHub proof‑of‑concepts, NVD metadata, social‑media trends and customer footprint… | ||
| Decoding Cyber Threats: A Practical Guide to Using Attack Trees | Gert-Jan Bruggink, Sherman Chu | 33m |
Attack trees provide a decision-first threat model that maps sequential events to controls, combining MITRE ATT&CK and the Diamond Model and often built in… | ||
| Blueprint for Maturity: Crafting a Tailored Cyber Threat Intelligence Maturity Model | Kiraga Slawek | 30m |
A practical CTI maturity framework claims to be both diagnostic and prescriptive and delivers 230 actionable granular controls mapped to the intelligence cycle… | ||
| How to Measure Quality os LLMs | Aaron Kaplan, Joy Jacobs, Paolo Di Prodi, Syra Marshall | 28m |
A CTI-specific benchmark is under construction with five concrete use cases: summarization, named entity recognition and relationship extraction; a released… | ||
| Processing Threat Reports at Scale Using AI and ML: Expectations and Reality | Yury Sergeev | 30m |
An automated pipeline ingests ~50,000 reports and finds about 50,000 reports / 2,200 useful items, follows links to fetch PDFs/GitHub/CSVs, tokenizes with… | ||
| How to Start Using Priority Intelligence Requirements (PIRs) on a Budget | Josh Darby MacLellan | 26m |
Claims a workable PIR program on a shoestring budget in 90 days using three phases: day 1–30 project setup, day 31–60 single stakeholder run-through, day 61–90… | ||
| The Disclosure Dilemma and Ensuring Defense | Joe Slowik | 24m |
Argues that disclosing specific indicators can blind defenders: publicizing APT28 certificate matching leads to the observed disappearance of that telemetry… | ||
| Enhancing Malware Code Similarity Detection through Vectorsearch and TLSH | Remco Sprooten | 25m |
Disassembles binaries into function-sized byte sequences, computes TLSH per-function hashes (treating the TLSH hex output as a vector), and indexes them in a… | ||
| Invisible Strings – Contemporary Challenges And Techniques Of Infrastructure Tracking | Kamil Bojarski | 29m |
Provides a repeatable infrastructure profiling method: a spreadsheet plus a bit.ly guide that records pivots, queries and observed values so searches are… | ||
| Source Pollution Attack - A Hidden Threat in Cybersecurity | Hsiang Yu, Syue Siang Su | 32m |
Source pollution means external feeds can be manipulated to break detection and cause real harm: the talk shows drum hash collisions that make C2 and benign… | ||
| Sharing Information and Intelligence without Disclosing It - Private Search Set (PSS) | Alexandre Dulaunoy, Jean-Louis Huynen | 28m |
Private Search Set (PSS) packages serialized Bloom filters and small metadata so teams can query indicators locally without revealing raw values, add watermark… | ||
| If CSIRTs are Knights, CTI Teams are Queens | Asger Deleuran Strunk, David Rüfenacht | 26m |
Claim: a compact, continuously updated CTI feed shortens the CSIRT’s UDA/OODA loop and yields faster containment. Proposal: a lightweight “thread actor resume”… | ||
| nothing matches | ||