34th Annual FIRST Conference 2022
2022-06-26..2022-07-01
Dublin, Ireland
as the organisers put it
Join the Global Security Conference: Register for the 34th Annual FIRST Conference, June 26-July 1, 2022.
who it's for
incident responders, cert operators, security analysts, threat intelligence analysts, soc analysts, vulnerability managers, security engineers
topics
ransomware recovery and resilience; software supply chain compromise; STIX custom objects and correlation; CVSS v4 supplemental metrics; malware analysis frameworks; EDR internals from defenders perspective; attack flow format for emulation; intelligence-driven threat hunting; IPv6 scanning and fingerprinting; reversing Golang binaries with Ghidra; CSAF 2.0 automated advisories; DNS exfiltration and defensive DNS
| title | author | length |
|---|---|---|
| FIRST SIG Updates | Dave Dugal, Rick Adrian, Nina Solha, Roderick Mooi, Mark Zajicek, Andreas Mühlemann, Olivier Caleff, Jeroen van der Hamm, Merike Kaeo, Art Manion, Aaron Kaplan, David Durvaux, Tom Millar | 57m |
CVSS work presents concrete changes: finer-grained base scoring, removal of scope in favor of separate confidentiality/integrity/availability for vulnerable vs… | ||
| 0-day In-the-Wild Exploitation in 2022...so far. | Maddie Stone | 35m |
Project Zero’s public ledger shows 18 in-the-wild 0-days in 2022 so far, of which 9 of 18 are variants and 4 repeat 2021 bugs; concrete cases include a win32k… | ||
| A Diamond is an Analysts Best Friend Introducing the Diamond Model for Influence Operations Analysis | Charity Wright | 28m |
Introduces a Diamond Model that puts narrative at the center and maps four corners: capabilities (bots, trolls, deep fake videos, paid budgets), infrastructure… | ||
| Attack Flow - Beyond Atomic Behaviors | Desiree Beck, Gabriel Bassett, Ryusuke Masuoka | 34m |
Defenders move from isolated indicators to a reproducible sequence format: a JSON Schema/JSON‑LD/RDF attack flow format published March with an accompanying… | ||
| Being A Better Defender By Channeling Your Worst Adversary: | John Stoner | 36m |
Built repeatable adversary emulations aimed at improving detection rather than prevention, mapping sequences to MITRE ATT&CK and delivering time-stamped… | ||
| Beyond Incident Reporting - An Analysis of Structured Representations for Incident Response | Daniel Schlette, Marco Caselli | 28m |
Compares existing formats (frameworks, playbook formats, granular command specs) and defines core concepts as workflow actuator action artifact, then adds… | ||
| Bridging Together Independent Islands - STIX Custom Objects and Matching Mechanisms to Correlate... | Toshitaka Satomi, Ryusuke Masuoka | 31m |
Demonstrates a working extension to STIX inside the OSS S-TIP platform that models real‑world entities (bank‑account, person) with a STIX Customizer, then… | ||
| Build Automated Malware Lab with CERT.pl Open-Source Software | Paweł Srokosz, Paweł Pawliński | 37m |
Central malware lab that stores files, structured configurations and text blobs is live as MWDB with a public service at mwdb.cert.pl and open-source… | ||
| CERT-UA: Research and Technical Analysis of Large-Scale Cyber Attacks in Ukraine in 2021 | Victor Zhora, Yevheniia Volivnyk, Yevhen Bryksin | 43m |
CERT‑UA describes building the UA30 cyber center with a SOC, cyber range and free government services, and documents a campaign of 1,306 incidents in 2022 that… | ||
| Community Management and Tool Orchestration the Open-Source Way via Cerebrate | Andras Iklody, Sami Mokaddem | 34m |
Cerebrate is an open-source contact database and orchestration layer built for MeliCERTES and already deployed in pilots; it links to Keycloak, exposes every… | ||
| Creating an Information Security/Information Assurance Program - Lessons Learned | Kenneth Grossman | 29m |
Creates IS/IA programs from ground up across three organizations and claims repeatable steps: map mission and jurisdiction, decide formal versus virtual team… | ||
| CSAF - the Magic Potion for Vulnerability Handling in Industrial Environments | Tobias Limmer, Thomas Pröll | 39m |
Siemens documents that automated advisory publishing using CSAF 2.0 is live (JSON feeds linked from advisories) and that volume rose to over 250 CVEs in 150… | ||
| CSIRT and SOC Modernization Practices | Vilius Benetis | 34m |
Practical roadmap for modernizing CSIRT/SOC: assess current operations, pick a maturity model (he recommends SIM3 or SOC‑CMM), map services to the new 26 roles… | ||
| Cyber Ireland - Addressing Cyber Crime Through Industry-Academia-Government Collaboration | Eoin Byrne | 38m |
Cyber Ireland establishes a national cluster that now represents 130 organisations and maps nearly 7,500 employees across 489 firms, reports €1.1B economic… | ||
| Cybersecurity Maturity in the Pacific Islands - Integrating CERT Services in a Regional Framework | Anthony Adams | 32m |
Research proposes a practical regional model built as a network of affiliated national CERTs aligned to each nation’s policy priorities and focused on specific… | ||
| Decoding the Diversity Discussion | Emma Jones | 33m |
Walks through the incident‑response lifecycle and gives specific, testable changes: rename “soft skills” to core skills, add checklists, flowcharts and short… | ||
| DNS as Added Security Against Ransomware Attacks | Artsiom Holub | 32m |
Recursive DNS logs reveal DNS tunneling used for C2 and exfiltration in real ransomware campaigns, with 78% of observed ransomware incidents using Cobalt… | ||
| Don't Blame the User! Stop the Phish Before it is Even Sent | Wout Debaenst | 26m |
Teams detect and block phishing long before inbox delivery by catching domain OPSEC mistakes and correlating related infrastructure: register-watch and… | ||
| EDR Internals From a Defenders Perspective | Olaf Hartong | 35m |
Microsoft Defender for Endpoint collects ETW and kernel callbacks into a local SQLite store (codename Direct Track Service) and uploads sampled telemetry to… | ||
| Endorsing the New Rules | Sherif Hashem | 40m |
UN GGE and UN OEWG reports gain unanimous endorsement and produce 11 norms for responsible state behaviour; the GGE expands from 15 to 25 members and spawns an… | ||
| Enhancing Operations Through the Tracking of Interactive Linux-based Intrusion Campaigns | Justin Swisher, Ami Holeston | 35m |
Tracks hands‑on‑keyboard Linux intrusions, noting raw counts rising from 660 in 2020 to 958 in 2021 and a jump from ~3–4 to dozens per week; uses MISP… | ||
| Follow the Dynamite: Commemorating TeamTNT's Cloud Attacks | Nicole Fishbein, Joakim Kennedy | 34m |
Chronological rundown of TeamTNT shows concrete TTPs: they scan with masscan and zgrab, weaponize exposed Docker APIs to pull Alpine images and chained shell… | ||
| Formulating An Intelligence-Driven Threat Hunting Methodology | Joe Slowik | 34m |
Proposes an operational, intelligence-driven hunting loop that ties adversary operations, visibility gaps, and organizational risk into testable hypotheses… | ||
| Global IR in a Fragmented World | Serge Droz | 30m |
Nation-state espionage dominates over cyberwar, with examples from Titan Rain (2003), GhostNet (2009) and Stuxnet (2010) and recent Exchange vulnerability… | ||
| Going with the (work)flow? Incident Response for Vicious Workflows | Ryan Robinson, Nicole Fishbein | 26m |
Researchers scan Internet-indexed Argo and Airflow instances and find concrete failures: thousands of exposed credentials and API keys (AWS, Azure, GCP… | ||
| How I Handled One of the Biggest Banking Fraud Incidents of 2020 | Daniel Oliveira De Lima, Thales Cyrino | 35m |
A combined campaign on Christmas night uses fake-bank sites proxying bank APIs and stolen internal credentials plus CDN masking to return real account balances… | ||
| How to Secure Your Software Supply Chain and Speed-Up DFIR with Hashlookup | Alexandre Dulaunoy, Jean-Louis Huynen | 35m |
Indexes hashes from Linux, Windows and many package sources into an open-source backend and public API, currently holding 25 billion keys and growing about 1… | ||
| How to Talk to a Board so the Board Will Talk Back | Helen Patton | 31m |
Most organizations present security to the board sparsely — some only see the full board once a year — so establish onboarding for directors, build a personal… | ||
| Improving Sector Based Incident Response | Justin Novak | 34m |
A new practical guide, the Sector CSIRT Framework, lays out six concrete steps—prerequisites, stakeholder surveys, gap analysis, a road map, staged… | ||
| Incident Response Investigations in the Age of the Cloud | Mehmet Surmeli | 31m |
Startup IoT build has AWS with EKS and a third‑party‑managed Jenkins; misconfigured Bitbucket SSO leaves public Jenkins via Bitbucket SSO and a script console… | ||
| Internet Spelunking: IPv6 Scanning and Device Fingerprinting | Piotr Kijewski, Dave De Coster | 41m |
Shadowserver scans tens of protocols from 37 servers over two 10Gb links, using ZMap/ZGrab, Condor job scheduling and a custom UDP sender called Railgun… | ||
| It's Just a Jump To The Left (of Boom) | Lindsay Kaye, Scott Small | 30m |
Shows that teams face 9,000+ open-source detection rules and 2,100+ offensive test scripts mapped to ~500 MITRE ATT&CK techniques, and describes building an… | ||
| Keynote: Cybersecurity's Image Problem and What We Can All Do About It | Victoria Baines | 01h 07m |
Research that close-reads government notices, vendor ads and criminal lures finds a pattern: visual metaphors (padlocks, blue light, faceless hoodie)… | ||
| Keynote: Online Child Sexual Abuse Material (CSAM): The Insider Attack You Have Not Seen Coming | Mick Moran, Romain Wartel | 01h 06m |
Insider misuse of work systems is shown with concrete outcomes: a disgruntled ex-employee runs a peer-to-peer eMule client on a former boss’s machine, causing… | ||
| Keynote: What Do We Owe One Another In Cybersecurity? | Wendy Nather | 01h 09m |
Argues that cybersecurity is a web of shared risk and calls for shared defense, backed by concrete findings: a study of 25 practices vs 11 outcomes finds… | ||
| Knowledge Management - Nourishing and Enhancing Your Communication and Intelligence | Rebecca Taylor | 32m |
A knowledge manager starts small, documents incident labels and now sees peaks across 1,400 IR engagements a year for 5,300 customers, 3 trillion events weekly… | ||
| Living with Ransomware - The New Normal in Cyber Security | Vishal Thakur, John Lopes | 33m |
Ransomware evolves into a persistent business model: actors sell ransomware-as-a-service, pivot from encryption to data-leak extortion, and sometimes dwell in… | ||
| More Than a CSIRT: Lessons Learned from Supporting a National Response to COVID-19 | Tom Millar, Joshua Corman | 37m |
CISA forms a COVID Task Force that pairs federal analysts with temporary experts, assesses the vaccine cold chain and tiered supply chain (tier 0 = R&D, tier 1… | ||
| Never Walk Alone: Inspirations From a Growing OWASP Project | Christian Folini | 35m |
OWASP ModSecurity Core Rule Set revives from three maintainers (2016) into a project with about 14 active developers, running the rules on over 100 Tbit/s and… | ||
| No More Ransomware in Critical Infrastructure! | Hank Chen | 29m |
Claims that analysis of 16 ICS ransomware yields a practical three‑phase defense: legacy signature scanning, an ICS pre‑detection kernel driver that flags four… | ||
| Open Source Doesn't Care About You, But You Should Care About It | Christopher R Robinson | 37m |
Open source often has no support contract and rarely matches vendor release schedules; expect to inherit responsibility for long-term patches and coordination… | ||
| Operation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ... | Daniel Lunghi, Jaromir Horejsi | 33m |
Multiplatform espionage campaign targets online gambling customers in Southeast Asia using Windows, Linux and macOS malware; observed families include PlugX… | ||
| Prioritizing Vulnerability Response with a Stakeholder Specific Vulnerability Categorization | Jonathan M. Spring | 37m |
SSVC v2 defines role-specific decision trees (supplier, deployer, coordinator) that map coarse answers to concrete actions, with an example Rockwell RCE… | ||
| Ransomware Incident Response - The Real-World Story of a Ransomware Attack | Joseph Carson | 41m |
Walkthrough of a CryLock incident where initial access comes from an RDP-exposed accountant box, escalates via RDP brute-force, and yields domain admin via a… | ||
| Ransomware, Risk, & Recovery: Protecting and Creating Resilience for Hybrid Active Directory | Calum Field | 32m |
Active Directory is the central attack vector and 90% of breaches touch it; one example shows 146 domain controllers wiped in 7 minutes and recovery can take… | ||
| Ransomware Stages of Grief | Tony Kirtley | 37m |
Secureworks runs ~1,000 IR engagements a year and has done >600 post‑detonation ransomware responses since 2018 and maps victim behavior to a grief curve… | ||
| Reversing Golang Binaries with Ghidra | Dorka Palotay | 33m |
Ghidra scripts parse Go’s PCLNTAB to recover real function names from stripped binaries, rescuing main.main and turning 1.3 MB blobs with ~1,790 functions back… | ||
| Rise of the Vermilion: Cross-platform Cobalt Strike Beacon Targeting Linux and Windows | Ryan Robinson, Avigayil Mechtinger | 37m |
Researchers find an ELF implant that implements a Cobalt Strike–compatible Beacon called Vermilion Strike, with a matching Windows DLL (stager seen from 2019)… | ||
| Sightings Ecosystem: A Data-driven Analysis of ATT&CK in the Wild | Kellyn Wagner Ramsdell, Mike Cunningham | 38m |
MITRE’s Sightings aggregates crowdsourced ATT&CK mappings and finds 6 million raw techniques reduced to 1.1 million usable techniques across ~800,000 sightings… | ||
| Speed is key: Leveraging the Cloud for Forensic Artifact Collection & Processing | Lukas Klein, Christian Koepp | 33m |
Staged PowerShell collectors (invoke-lr-collection downloads and validates a stager; invoke-triage-collection captures memory then triage artifacts) encrypt… | ||
| Traffic Light Protocol 2022: Updates for An Improved Sharing Experience | Tom Millar, Don Stikvoort, Ted Norminton | 01h 07m |
FIRST publishes TLP v2.0 that renames TLP CLEAR (replacing white), adds TLPM RESTRICT (amber+strict) and formal definitions for colors table and… | ||
| The Blue Side of Documentation | Nicholas Dhaeyer | 30m |
Created a usable SOC knowledge base by consolidating scattered Confluence pages into a prioritized training and workflow hub, assigning one owner per topic… | ||
| There is No TTP | Martin Eian | 34m |
Argues that “TTP” is a false construct: MITRE ATT&CK mainly models techniques only, leaving tactics and procedures undefined; techniques often describe… | ||
| Threats versus Capabilities Building Better Detect and Respond Capabilities | Thomas Fischer | 37m |
Argues that MITRE-style TTP lists aren’t enough for detection and proposes a practical, threat-driven process: pick the few prioritized threats, enumerate… | ||
| The SolarWinds Supply Chain Compromise | Erik Hjelmvik | 34m |
Reconstructs the Sunburst DNS command‑and‑control protocol, shows a one‑byte XOR, per‑host victim IDs and a 19‑bit timestamp, and provides a working Sunburst… | ||
| Timing is Everything: Generic Trigger Events for Malware Memory Dumping | Mateusz Lukaszewski, Patrick Staubmann | 28m |
Researchers define a small, generic set of memory-dump triggers that catch unpacked payloads across many families without per-family rules: first network… | ||
| VEXed by Vulnerabilities That Don't Affect Your Product? Try This! | Allan Friedman, Thomas Schmidt | 37m |
A machine-readable way to state that a vulnerability does not affect a product is now defined as a VEX profile of the OASIS CSAF format. It links product… | ||
| Watching Webpages in Action with Lookyloo | Raphaël Vinot, Quinn Norton | 36m |
Lookyloo captures pages in a configured headless browser and builds a phylogenetic resource tree showing time‑ordered requests, hashes every resource, stores… | ||
| Who Do You Think You Are? | Stuart Murdoch | 37m |
Maps how vulnerability and incident-data standards and sharing bodies actually evolved: CVE feeds identifiers into IODEF XML schema (IODEF published ~2007)… | ||
| Who Shares Wins | Jaap van Oss | 32m |
A banking cyber team builds a program called Who Shares Wins that codifies sharing with legal sign‑off, an auditable tracker and a two‑person maker/checker… | ||
| Your Phone is Not Your Phone: A Dive Into SMS PVA Fraud | Vladimir Kropotov | 37m |
A criminal operation preloads Android ROMs and OTA updates to control an estimated 20M devices across 180 countries, installs a plugin framework that captures… | ||
| nothing matches | ||