SANS DFIR Summit & Training 2026

Thu, Oct 15 - Thu, Oct 22, 2026
15 Courses
12 CPEs (Summit Only)
1 NetWars Tournament
English

Arlington, VA & Virtual (ET)

Jump to:

Event Highlights
Courses
Sponsors
Schedule
Location

Summit: Oct 15-16 | Training: Oct 17-22

All of DFIR. One Event.

Digital Forensics | Incident Response | Ransomware | Threat Hunting

Slide 1 of 2
Slide 2 of 2

The SANS DFIR Summit & Training is back—in a new city, a new season, and with our most in-depth program yet.

This year, the Summit has expanded to tackle today’s most challenging DFIR topics—from core digital forensics and incident response to focused deep dives in threat hunting and ransomware—through expert-led talks, open-source tool sessions, and more hands-on opportunities than ever before.

If staying sharp on the latest research, tools, and investigative tradecraft matters to you, this is where you need to be.

“Every talk has a little nugget that you can add to your forensic toolbox no matter what your forensic wheelhouse may be. This is a must-attend event.” - A. Sparling

What Attendees Say

Slide 1 of 4
The DFIR Summit never disappoints and is still the #1 DFIR event. As a leader, it allows me to keep a pulse on cutting-edge research and to meet folks.
Brad Garnett
Slide 2 of 4
I've been to large events where I only saw 3 people out of 3,000 that I knew. I came to the DFIR Summit, and saw 30 out of 300. This is like a good family reunion, a time to rejuvenate and reconnect with my "tribe."
Frank McClain
Slide 3 of 4
For new and veterans alike, the info you get from the Summits are second to none. This was my first Summit! I can't wait for the next one!
Mike Lentoski
Slide 4 of 4
This Summit creates a ton of new ideas on how to improve our incident response processes.
Andy V.

The knowledge you'll absorb in just two days will last the entire year. Whether you’re attending your first DFIR Summit or returning for your seventeenth, you'll join a community that shares a common drive to seek truth through digital forensics and eradicate attackers during incident response engagements.

Summit Highlights

Highly Technical Talks and Sessions

The industry's top practitioners will share their latest digital forensics and incident response research, solutions, tools, and case studies.

DFIR Summit & Training 2025, Highly Technical Talks

One-of-a-Kind Networking with the Top Minds in DFIR

You’ll have the chance to engage with Summit Chairs, speakers, and your peers in the community for deep-dive discussions, and casual chats over breaks, meals, and an evening reception.

Summit@Night

The days will be filled with the latest in DFIR, but the fun goes up a notch at night for those joining us in Arlington.

Solutions Expo Hall

Explore the latest tools and solutions in digital forensics, incident response, and threat hunting.

World-Class SANS Courses

Enhance your knowledge base and add to your toolkit by bundling your Summit experience with a hands-on, immersive course taught by top SANS instructors and course authors.

Early Bird Offer

Save $500 USD using the code "EarlyBirdNA" and pay for any 4-6 day course (excluding Beta Courses and 300 Level Courses) by August 30, 2026.

Register

Summit and Course Registration

$995 USD

In personIncludes

Course: Live Instructor Training with Hands-on Exercises
Course: DFIR NetWars Tournament with purchase of a course
Summit: Talks, Presentations and Workshops
Summit: Unmatched Networking
Summit: Evening Reception
Summit: Access to Summit Exhibit Hall
Summit: Lunch and light refreshments will be provided during the event and scheduled breaks

Select course to Enroll

Live onlineIncludes

Course: Virtual Live Instructor Training with Hands-On Exercises
Summit: Access to Select Talks
Summit: Interactive Chat on Slack
First Access to Approved Recordings and Decks

Select course to Enroll

Summit Registration Only

Free

$525 USD*Prices exclude applicable local taxes

In personIncludes

Talks, Presentations and Workshops
Unmatched Networking
Evening Reception
Access to Summit Exhibit Hall
Lunch and light refreshments will be provided during the event and scheduled breaks
First Access to Approved Recordings and Decks

Attend In PersonLogin to register

Free

Live onlineIncludes

Access to Select Talks
Interactive Chat on Slack
First Access to Approved Recordings and Decks

Important Dates

Refund Deadline:: September 28, 2026
Hotel Group Discount Deadline:: September 22, 2026

Courses

Looking for Group Purchasing? Contact Us

Showing 15 of 15

Filter by:

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

FOR508Digital Forensics and Incident Response, Artificial Intelligence

GIAC Certified Forensic Analyst
6 Days
36 CPEs
Carlos Cajigas

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR563: Applied AI for Digital Forensics and Incident Response: Leveraging Local Large Language Models

FOR563Digital Forensics and Incident Response, Artificial Intelligence

FOR509: Enterprise Cloud Forensics and Incident Response

1 Day
6 CPEs
Mari DeGrazia

Starts 19 Oct 2026 at 9:00 AM ET
$995 USD (Course)
*Prices exclude applicable local taxes

Starts 19 Oct 2026 at 9:00 AM ET
$995 USD (Course)
*Prices exclude applicable local taxes

View course details

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

FOR610Digital Forensics and Incident Response

GIAC Reverse Engineering Malware
6 Days
36 CPEs
Lenny Zeltser

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR500: Windows Forensic Analysis

FOR500Digital Forensics and Incident Response

GIAC Certified Forensic Examiner
6 Days
36 CPEs
Ovie Carroll

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR585: Smartphone Forensic Analysis In-Depth

FOR585Digital Forensics and Incident Response, Artificial Intelligence

GIAC Advanced Smartphone Forensics
6 Days
36 CPEs
Josh Hickman

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

FOR572Digital Forensics and Incident Response

GIAC Network Forensic Analyst
6 Days
36 CPEs
Philip Hagen

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR518: Mac and iOS Forensic Analysis and Incident Response

FOR518Digital Forensics and Incident Response

GIAC iOS and macOS Examiner
6 Days
36 CPEs
Sarah Edwards

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR578: Cyber Threat Intelligence

FOR578Digital Forensics and Incident Response

GIAC Cyber Threat Intelligence
6 Days
36 CPEs
Rebekah Brown

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR498: Digital Acquisition and Rapid Triage

FOR498Digital Forensics and Incident Response

GIAC Battlefield Forensics and Acquisition
6 Days
36 CPEs
Kevin Ripa

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR509: Enterprise Cloud Forensics and Incident Response

FOR509Digital Forensics and Incident Response

GIAC Cloud Forensics Responder
6 Days
36 CPEs
Megan Roddie-Fonseca

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR608: Enterprise-Class Incident Response & Threat Hunting

FOR608Digital Forensics and Incident Response

GIAC Enterprise Incident Responder
6 Days
36 CPEs
Mike Pilkington

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR528: Ransomware and Cyber Extortion

FOR528Digital Forensics and Incident Response

3 Days
24 CPEs
Ryan Chapman

Starts 17 Oct 2026 at 8:30 AM ET
$4,200 USD (Course)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$4,200 USD (Course)
*Prices exclude applicable local taxes

View course details

FOR577: LINUX Incident Response and Threat Hunting

FOR577Digital Forensics and Incident Response, Artificial Intelligence

GIAC Linux Incident Responder
6 Days
36 CPEs
Terrance Maguire

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR589: Cybercrime Investigations

FOR589Digital Forensics and Incident Response

5 Days
30 CPEs
Conan Beach

Starts 17 Oct 2026 at 8:30 AM ET
$8,260 USD (Course)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,260 USD (Course)
*Prices exclude applicable local taxes

View course details

FOR478: Cyber Threat Intelligence Foundations

FOR478Digital Forensics and Incident Response, Artificial Intelligence

2 Days
12 CPEs
John Doyle

Starts 20 Oct 2026 at 8:30 AM ET
$3,505 USD (Course)
*Prices exclude applicable local taxes

Starts 20 Oct 2026 at 8:30 AM ET
$3,505 USD (Course)
*Prices exclude applicable local taxes

View course details

Thank You To Our Sponsors

Schedule

Summit Dates

Thursday, Oct 15th - Friday, October 16th

Training Dates

Saturday, October 17th - Thursday, October 22nd

Showing 27 of 47

Filter by:

Select day:

Breakfast, Credential Pick Up & Solutions Expo

08:00AM - 09:00AM EDT

In-Person

Opening Remarks

08:45AM - 09:00AM EDT

In-Person & Virtual

Presented by

Ovie Carroll

Director at DOJ Cybercrime Lab

Mari DeGrazia

Certified Instructor at SANS Institute

Ryan Chapman

Team Lead, Managed Threat Hunting at Palo Alto Networks

Keynote | Anti-Forensics in the Idaho Murders Case: The Traces He Left Trying to Leave No Trace

09:00AM - 09:35AM EDT

In-Person & Virtual

Presented by

Heather Barnhart

DFIR Curriculum Lead and Head of Faculty at SANS Institute

Keynote | Title To Be Announced

Speaker: Jason Higley

09:35AM - 10:10AM EDT

In-Person & Virtual

In Conversation: Heather Barnhart & Jason Higley

10:10AM - 10:30AM EDT

In-Person & Virtual

Presented by

Heather Barnhart

DFIR Curriculum Lead and Head of Faculty at SANS Institute

Break & Track Transition

10:30AM - 10:50AM EDT

In-Person & Virtual

When Google Sends the Phish: Abusing Legitimate Infrastructure and Sender Identity in a Live Vishing Attack

Vishing attacks targeting Google accounts have grown more sophisticated — not by breaking authentication systems, but by weaponizing them. This talk presents a forensic case study of a real, coordinated attack that combined display-name header spoofing with deliberate abuse of Google's account recovery notification infrastructure to deliver a fully authenticated, DKIM-signed Google security alert directly to the victim's inbox.

The attack began with a phone call impersonating Google Support, followed by two precisely timed emails. The first was a spoofed phishing lure — appearing as "support@google" while originating from attacker-controlled infrastructure at case-priority.com, relayed through MailChannels and Hostinger, with SPF passing on the envelope sender while the visible From header pointed to a non-existent domain. The second required no spoofing at all: the attacker added the victim's address as a recovery contact on a throwaway Gmail account, then triggered account changes — causing Google's own servers to send a legitimate security alert to the victim's inbox. The contrast between the two emails is forensically significant and operationally underappreciated.

Attendees will learn to identify SPF alignment failure behind a passing SPF result, read SMTP relay chains to surface attacker infrastructure, and distinguish display-name spoofing from envelope spoofing in raw headers. The talk concludes with a MITRE ATT&CK mapping of the full attack chain, header-level IOCs, and hardening recommendations for Google Workspace environments that DFIR practitioners can implement immediately.

DFIR Track

10:50AM - 11:15AM EDT

In-Person & Virtual

Presented by

Dr. Mahesh Kalappattil

Sr. Principal Engineer at Palo Alto Networks

Stopping Ransomware Before Encryption - Threat Hunting Lessons from a Real-World Identity Attack

Speaker: Bryson Byrd

Every ransomware investigation begins long before encryption. Success depends on recognizing the seemingly ordinary activity attackers use to establish access, move through an environment, and position themselves before launching the final stage of an attack. Using a real-world incident involving Fusion Computing, presenters reconstruct an identity-driven intrusion that was identified and contained before ransomware could be deployed.

Attendees will follow the investigation from an initial social engineering phone call through PowerShell execution, command-and-control activity, and living-off-the-land techniques that initially blended with legitimate administrative behavior.

Bryson demonstrate how endpoint telemetry, identity signals, and forensic artifacts were used to reconstruct the attack timeline, validate attacker activity, identify the evidence that mattered most, and prioritize containment decisions before encryption could occur. The session also examines how the observed techniques map to the MITRE ATT&CK framework, highlighting practical opportunities to improve visibility into identity-based attacks and strengthen threat hunting workflows.

Participants will leave with practical hunting techniques for detecting identity-driven intrusions, investigative approaches for validating attacker activity, and recommendations for strengthening ransomware detection before encryption begins.

Ransomware Track

10:50AM - 11:15AM EDT

In-Person & Virtual

OneDrive - Let's Take This Offline

Microsoft OneDrive Offline Mode stores significantly more than synchronized files. Modern versions of the client cache data from Outlook, Microsoft Teams, and SharePoint, creating a rich source of forensic evidence that is often absent from traditional acquisition and analysis workflows. Investigators who understand these artifacts can recover valuable context about user activity even when cloud access is unavailable.

This session provides a deep technical examination of OneDrive Offline Mode artifacts and demonstrates how to identify and analyze files associated with email, calendar events, meeting invitations, Teams chats, and SharePoint data. The presentation explains where these artifacts are stored, how they relate to one another, and techniques for reconstructing user activity across Microsoft 365 services.

The session also examines OneDrive's Optical Character Recognition (OCR) metadata, showing how text extracted from images and documents can become valuable investigative evidence while also introducing privacy and security considerations. Attendees will learn how OCR data is stored, what information can be recovered, and the implications for incident response, insider threat investigations, and enterprise data protection.

Using real artifacts and practical demonstrations, attendees will gain a repeatable methodology for locating, parsing, and correlating OneDrive Offline Mode data. They will leave with actionable techniques that can be immediately incorporated into forensic collections, artifact triage, and Microsoft 365 investigations.

DFIR Track

11:15AM - 11:40AM EDT

In-Person & Virtual

Presented by

Brian Maloney

Lead IT Security Analyst at Thrivent Financial

Threat Hunting and Ransomware Resilience in Modern OT and Manufacturing Environments

Speaker: Abdul Khadir

Threat hunting has become a critical capability for organizations facing increasingly sophisticated ransomware attacks. While many security teams rely heavily on automated detection tools, advanced adversaries continue to evade traditional controls by exploiting identity systems, abusing legitimate administrative tools, and moving laterally across hybrid IT and operational technology (OT) environments.

This session presents a practical, intelligence-driven threat hunting methodology that enables defenders to proactively identify attacker behaviors before ransomware deployment.

Drawing from real-world experience securing global manufacturing environments, the presentation demonstrates how organizations can build effective threat hunting programs by combining endpoint telemetry, identity analytics, network traffic analysis, SIEM, XDR, threat intelligence, and behavioral analytics. The session will cover hypothesis-driven hunting, mapping attacker techniques to the MITRE ATT&CK framework, detecting living-off-the-land (LOTL) activity, identifying early indicators of ransomware campaigns, and prioritizing hunts using risk-based intelligence.

Attendees will learn practical hunting workflows, detection engineering techniques, and investigation strategies that can be implemented using commonly deployed enterprise security platforms. The presentation will also discuss lessons learned from enterprise environments, common mistakes organizations make during ransomware investigations, and recommendations for improving detection coverage and incident readiness.

Key Takeaways:

Develop a repeatable threat hunting methodology aligned with the MITRE ATT&CK framework.
Detect ransomware activity before encryption by identifying attacker behaviors and lateral movement.
Build intelligence-driven hunts using endpoint, identity, and network telemetry.
Improve detection engineering, incident response, and ransomware resilience across enterprise and hybrid IT/OT environments.
Apply practical techniques that attendees can immediately implement within their own organizations to strengthen proactive cyber defense

Ransomware Track

11:15AM - 11:40AM EDT

In-Person & Virtual

From Siri to Siri AI: Exploring The Curious Case of Apple and Its Intelligence

The architectural advancements to Siri and Apple Intelligence as part of iOS 27 and macOS 27 fundamentally alter the nature of user-device interaction. The OS is no longer a passive tool waiting for commands, but it has transitioned to a system capable of autonomous, context-driven action on behalf of the user. The next-generation Apple Intelligence and Siri AI possess onscreen awareness, contextual understanding, and read/write access to the user's data.

When an operating system natively summarizes user documents, alters the tone of text including messages, or generates almost real looking synthetic images, the difference between human-authored and algorithmic generation becomes blurry to the investigators.

This talk establishes a forensic framework for analyzing Apple Intelligence and reveals the undocumented forensic artifacts left behind by the next-generation Apple Intelligence and the entirely rebuilt Siri AI on iOS27 and macOS 27. We will perform a deep dive into the specific, undocumented file system hierarchies where prompt histories live, how "deleted" AI sessions persist, and the Apple Intelligence logs that commercial tools currently miss.

Attendees will leave with an open-source tool and an evidence-based methodology to identify human-authored, AI-generated, and AI-modified content.

DFIR Track

11:40AM - 12:05PM EDT

In-Person & Virtual

Presented by

Bhargav Rathod

Staff MDR Analyst at Palo Alto Networks

Debasis Parida

Security Researcher

Breathes and Shuffles: Exposing Heuristic Blindspots in EDR Ransomware Detection Engines

Speaker: Michał Sołtysik

Modern Endpoint Detection and Response (EDR) platforms heavily publicize their ability to block ransomware through real-time behavioral correlation, file-system telemetry, and API hooking. However, these detection layers rely on predictable heuristic metrics, such as high-frequency cryptographic API calls and linear directory traversing.

This presentation demonstrates how progressive structural changes can completely blind enterprise defenses without changing the operational outcome of a simulation. Through an iterative, 12-stage analysis of a purpose-built evaluation agent, we map exactly how signature scanners and behavioral engines fail when confronted with execution-delay jitter, directory-walk elimination, and user-space stream transforms.

We will reveal how shifting from standard API frameworks (like .NET CryptoStream) to custom, user-mode byte manipulation (ProcessFileStealth) easily neutralizes static heuristics. Furthermore, we demonstrate how avoiding recursive directory loops via flat enumeration techniques undercuts an EDR's correlation logic. Attendees will walk away with concrete data on engine blind spots and practical testing methodology to validate their own defensive posture against low-and-slow execution vectors.

Ransomware Track

11:40AM - 12:05PM EDT

In-Person & Virtual

To Be Announced

DFIR Track

12:05PM - 12:30PM EDT

In-Person & Virtual

Proving What Left the Building: Reconstructing Rclone Exfiltration from Memory Evidence

Speaker: Jason Trapp

"What data was taken?" is one of the first questions legal counsel asks during a ransomware engagement, and in most cases, it's the hardest question to answer. Rclone has become the de facto exfiltration tool used by ransomware affiliates: it's free, flexible, and quiet. Analysts typically fall back on firewall logs for a byte count however, this doesn’t tell us what has been taken.

This session demonstrates how to turn a memory image, which can be paired with a packet capture, into an inventory of exfiltrated files. It dissects what rclone leaves in memory, including execution artifacts, command line arguments, and the config file. These details include the deobfuscated remote location, which reveals the destination service, the account, and the master key. From the packet capture, the tool carves the encrypted uploaded blobs, collects the exact file sizes, and then correlates them with the memory artifacts, source directory listings, and file sizes. This session shows why capture timing affects what you can collect: account keys, file encryption keys, and transport keys. During this session, a free tool that automates this and formats the output for executives and legal counsel to help drive notification decisions as well as the limitations of this tool.

Ransomware Track

12:05PM - 12:30PM EDT

In-Person & Virtual

Lunch & Solutions Expo

12:30PM - 01:20PM EDT

In-Person

Evidence Isn't on Disk: A DFIR Playbook for Compromised MCP Servers and AI Coding Agents

Speakers: Samuel Addington & Christopher Earl

In July 2025, Check Point Research disclosed MCPoison (CVE-2025-54136, CVSS 7.2), a flaw in Cursor IDE (versions ≤ 1.2.4) where the Model Context Protocol trust model bound approval to an MCP server's name rather than its command or arguments. An attacker commits a benign .cursor/rules/mcp.json to a shared repository; a developer approves it once; the attacker later swaps in a reverse shell that runs silently on every project open — persistent RCE with no second prompt.

A companion flaw, CurXecute (CVE-2025-54135, CVSS 8.6), reached the same outcome through prompt injection that wrote to ~/.cursor/mcp.json and executed even after the user rejected the change.

These two incidents expose the problem this session tackles: when the acting entity is an AI agent, the authentication event is legitimate, the spawning process is the expected runtime, and the action falls within the agent's granted permissions so conventional EDR timelines show nothing anomalous, and the triggering instruction frequently lives only in ephemeral prompt context that does not survive default log retention.

The session reproduces both CVEs live on an isolated host, then contrasts their forensic footprints: MCPoison leaves recoverable on-disk evidence (git history of the config, file modification times, file-integrity-monitoring hits), while the prompt-injection path leaves almost nothing once the session closes. From that contrast the presenter derives a NIST-mapped incident-response playbook for agentic systems what to preserve before containment, how to triage runtime-escape versus privilege-boundary-escape versus reasoning-compromise incidents, and how to instrument MCP tool-call telemetry so the originating instruction is captured as evidence rather than lost.

Attendees leave with the lab build (vulnerable and patched configs), a forensic-artifact collection checklist for MCP and agent incidents, file-integrity-monitoring and detection logic for mcp.json tampering, and an open-source telemetry wrapper that records agent tool calls and their originating context in a retention-safe format.

DFIR Track

01:20PM - 01:45PM EDT

In-Person & Virtual

Presented by

Samuel Addington

AI Researcher and Professor at California State University Long Beach

Unpatched, Unsegmented, Unprepared: A Ransomware Recovery Insight

Speaker: Javid Bakhtiani & Sarah Bukhari

When a manufacturing organization with two physical sites was compromised through an unpatched FortiGate 60E firewall running a vulnerable FortiOS 7.2.2 build affected by CVE-2022-42475, alongside a set of end-of-life Windows Server 2012 hosts, the incident response team uncovered far more than encrypted files. The environment had a fully flat network with switch loopbacks, no DHCP failover, and backups that had never been audited, meaning entire servers were missing from the backup set without anyone knowing.

This session walks through the full incident lifecycle: initial access through the unpatched firewall and legacy servers, confirmed data exfiltration alongside encryption, forensic preservation through full host imaging and triage collection before any remediation began, and the decision to pursue a decryptor rather than risk an estimated 50 percent data loss across the environment, including Active Directory.

Attendees will see the exact hardening checklist used across both sites, covering network containment, Active Directory and Kerberos resets, GPO and credential audits, and EDR plus anti-ransomware deployment, along with the specific gaps in the client's prior security posture that allowed the incident to happen in the first place.

This talk is built for both technical responders who want the operational detail and less technical attendees who need to understand how a single unpatched device cascades into a two-site recovery effort.

Ransomware Track

01:20PM - 01:45PM EDT

In-Person & Virtual

From Alert to Intent: Investigating Insider Data Exfiltration Across USB, Email, and Cloud in Enterprise DFIR

Speakers: Justin Price & Rakesh Kumar Narsingoju

Enterprise data exfiltration rarely presents as a clear, high-confidence alert. Instead, investigators must determine whether observed activity reflects legitimate business use or policy-violating or malicious behavior using incomplete and often ambiguous telemetry. This session presents real-world DFIR investigations involving insider-driven data movement across removable media, email, and cloud channels, where initial detections alone were insufficient to determine risk or intent.

The talk examines multiple investigation patterns observed in enterprise environments, including long-duration accumulation of data to removable media, burst exfiltration events where most transfers occur within a short timeframe (such as hours preceding user termination), and multi-channel movement combining USB transfers, email forwarding to personal accounts, and cloud-sharing activity.

Additional scenarios include misuse of legitimate access (where data aligns with a user’s role but is accessed or transmitted outside expected context) and repeated low-volume transfers designed to evade threshold-based detections. Attendees will follow the investigation sequence used to expand alerts into full-scope cases, including correlating endpoint telemetry such as DeviceFileEvents for removable media activity, email telemetry such as EmailEvents and attachment metadata, and identity signals related to account activity and user lifecycle changes. The session demonstrates how investigators perform historical lookbacks, validate data sensitivity through targeted sampling, and establish behavioral baselines to identify anomalies in volume, timing, and access patterns.

The presentation highlights a critical limitation in traditional DFIR workflows: activity-based detections alone cannot distinguish between legitimate use and data exfiltration without contextual and behavioral analysis. To address this, the session introduces a repeatable investigation methodology that includes classification of exfiltration patterns (slow accumulation, burst transfer, and multi-channel movement), a correlation framework linking endpoint, email, and cloud telemetry, and a decision model for assessing user intent in ambiguous scenarios.

Attendees will leave with practical, directly applicable outputs, including an investigation checklist for multi-channel data movement, behavioral indicators for identifying suspicious activity, and detection and correlation approaches that can be adapted within platforms such as Microsoft Defender XDR or similar environments.

DFIR Track

01:45PM - 02:10PM EDT

In-Person & Virtual

To Be Announced

Ransomware Track

01:45PM - 02:10PM EDT

In-Person & Virtual

To Be Announced

DFIR Track

02:10PM - 02:35PM EDT

In-Person & Virtual

To Be Announced

Ransomware Track

02:10PM - 02:35PM EDT

In-Person & Virtual

Break

02:35PM - 03:00PM EDT

In-Person

WORKSHOP | Threat Hunting and Criminal Infrastructure

DFIR Track

03:00PM - 05:00PM EDT

In-Person

Presented by

Conan Beach

Special Agent at U.S. Government

To Be Announced

DFIR Track

03:00PM - 05:00PM EDT

In-Person

Ransomware Hands-On Workshop | Title To Be Announced

Ransomware Track

03:00PM - 05:00PM EDT

In-Person

Presented by

Ryan Chapman

Team Lead, Managed Threat Hunting at Palo Alto Networks

WORKSHOP | Operation Phantom Thread

Threat Hunting Track

03:00PM - 05:00PM EDT

In-Person

Presented by

Carlos Cajigas

Chief Technology Officer at Covert Bit

SANS Social

After a full day of DFIR insights, it is time to step away from the screens and join us upstairs at The View for the SANS Social. Take in breathtaking panoramic views of Washington, DC while enjoying drinks, food, and entertainment with fellow attendees, speakers, and SANS experts. It is the perfect chance to unwind, continue the day’s conversations, make new connections, and enjoy a great evening with the DFIR community.

06:00PM - 08:00PM EDT

In-Person

Breakfast & Solutions Expo

08:00AM - 09:00AM EDT

In-Person

Opening Remarks

09:00AM - 09:10AM EDT

In-Person & Virtual

Presented by

Ovie Carroll

Director at DOJ Cybercrime Lab

Ryan Chapman

Team Lead, Managed Threat Hunting at Palo Alto Networks

Mari DeGrazia

Certified Instructor at SANS Institute

Keynote | The AI System Was the Victim: Forensics for a Crime Scene With No Disk Image

09:10AM - 09:50AM EDT

In-Person & Virtual

Presented by

Raymond DePalma

Principal DFIR Technical Architect, Unit 42 Engineering Team at Palo Alto Networks

Rogue VM Chronicles: Forensic Reconstruction of a Scattered Spider Intrusion

Traditional endpoint detection and response (EDR) agents are powerful, but what happens when threat actors bypass them entirely by spinning up their own unmanaged systems within your hypervisor? Unit 42 investigated a complex intrusion where the notorious threat group Scattered Spider (aka Muddled Libra, UNC3944) did exactly that. nd older Outlook versions on Reddit.

After leveraging social engineering to gain administrative credentials, the threat actors accessed the victim's VMware vSphere portal, created an unmanaged rogue virtual machine, and utilized it as an operational beachhead to conduct actions on objectives.

Fortunately, the security team terminated the attackers' access before they could delete the rogue VM, leaving behind a highly valuable forensic record. This presentation delivers a forensic reconstruction of Scattered Spider’s active playbook built directly from the artifacts recovered from that beachhead system. We will walk through the exact 15-hour timeline, detailing the group's living-off-the-land tradecraft and distinct troubleshooting behaviors.

Attendees will learn the technical mechanics of:

• Establishing persistence using an SSH tunnel hosted in an attacker-controlled AWS S3 bucket.

• Disabling and powering down virtualized domain controllers via vSphere, mounting their VMDK disks, and copying the NTDS.dit database and SYSTEM registry hive to decrypt and harvest domain-wide credential hashes.

• Executing Active Directory enumeration tools, and specifically targeting various computing services to map critical infrastructure.

• Navigating SaaS cloud databases and attempting to exfiltrate sensitive Outlook PST files via the S3 Browser tool.

We will also analyze the threat actor's real-time struggles documented in their browser history: searching Bing for how to bypass blocked file-sharing sites, troubleshooting Outlook speed issues, and researching how to find older Outlook versions on Reddit.

09:50AM - 10:30AM EDT

In-Person & Virtual

Presented by

Cuong Dinh

Consulting Director at Palo Alto Networks - Unit 42

Justin De Luna

Senior Consultant at Palo Alto Networks - Unit 42

Break & Track Transition

10:30AM - 10:50AM EDT

In-Person & Virtual

The Invoice Is the Payload: Incident Response for Cloud Cryptojacking and LLMjacking

Ransomware is bad, but at least you get choices. Pay, do not pay, restore from backup, call the FBI. Bad options, but options. Cloud and AI hijacking does not work like that. There is no decryptor, nobody to negotiate with, no wallet to trace. The attacker gets what they came for, the provider gets paid, and you get the invoice.

Hijacking other people's machines is not new, but what it is worth has changed. In the 2000s it was sabotage and botnets. By the 2020s it was crypto mining, stealing compute to mine coins. Now it is AI: a stolen cloud key buys frontier model access, and that is not just a bill, it is free R&D. The most interesting buyers are the ones who cannot get it legitimately, actors under sanctions or export controls who now have a way to rent capability they are embargoed from buying.

I respond to these for a living. I will walk two anonymized cases and what they cost: a GCP cryptojacking job off a leaked service account that ran into the tens of thousands in hours, and an LLMjacking case on a stolen key that reached six figures before anyone noticed. For a small company either one is not a dispute, it is the end of the business. Then the harder question: as defenders we are failing at this, and I will be specific about why, what the response actually looks like when there is no host and no malware to grab, and the GCP, AWS and Azure cheat sheet you can take back to the SOC.

DFIR Track

10:45AM - 11:10AM EDT

In-Person & Virtual

Presented by

Erblind Morina

Principal Incident Response Consultant at IBM X-Force

Squidoor - Dissecting A Sophisticated Multi-Platform Malware Used By A Chinese APT

This talk will delve into a highly sophisticated Chinese APT campaign, tracked as CL-STA-0049, that has been targeting governments, defense, telecommunication, education and aviation sectors in Southeast Asia and South America since at least March 2023. This campaign demonstrates a high level of complexity, utilizing a multi-stage attack chain and employing advanced evasion techniques to bypass traditional security measures.

At the heart of this operation lies "Squidoor", an advanced backdoor exemplifying evolving state-sponsored tactics. This sophisticated backdoor features both Windows and Linux versions, employing an unprecedented array of 10 different C2 communication methods, including rarely seen techniques like abusing Outlook for C2 communication.

In the presentation, we will first share the different TTPs the threat actor used to gain access to the victim network and deliver the "Squidoor" malware.

Second, we will provide a thorough and detailed technical malware analysis of the "Squidoor" malware. We will begin with the execution flow of the malware involving LOLBAS and shellcode. Next, we will dive into the 10 different C2 communication methods Squidoor is able to utilize and explain how they work. And finally we will touch upon Squidoor's different capabilities and encryption protocols it's utilized as part of the c2 communication.

We will end the presentation with giving the audience practical ways to hunt for the Squidoor malware. By the end of the talk, attendees will gain a unique glimpse into the inner working of sophisticated Chinese APT tooling and operations.

Threat Hunting Track

10:45AM - 11:10AM EDT

In-Person & Virtual

Presented by

Tom Fakterman

Senior Threat Researcher at Palo Alto Networks

Lior Rochberger

Principal Threat Researcher at Palo Alto Networks

Tracing AI-Assisted IDEs: Forensic Artifacts, Agent Observability, and Software Supply Chain Risk

AI-assisted IDEs and coding tools are becoming part of normal developer workstation activity, but most DFIR playbooks still treat them as background applications rather than forensic evidence sources. This creates a visibility gap during developer compromise and software supply chain investigations: responders may see file changes, package installs, or repository activity, but miss the local session context, tool activity, workspace state, and configuration that explain how those actions occurred.

This session presents a DFIR-focused artifact study of AI-assisted developer environments such as VS Code with GitHub Copilot, Cursor, Claude Code, Codex, and related IDE- or terminal-based coding assistants. The research will compare the local traces these tools can leave behind, including session history, workspace context, prompts, tool outputs, command traces, debug logs, extension data, configuration files, local observability records, and repository-level instructions. It will also examine how these environments intersect with traditional attacker targets such as environment variables, API tokens, SSH keys, credential stores, package-manager credentials, and source-control authentication.

The talk will map these artifacts to realistic investigation scenarios involving malicious packages, suspicious editor or extension behavior, credential exposure, risky activities, and downstream CI/CD abuse. The focus will be on how these artifacts can be parsed, what important activity can already be observed through current EDR, endpoint, editor, source-control, and enterprise telemetry, and where visibility gaps remain for responders investigating compromised developer workstations.

The session will also discuss open-source tooling opportunities to make this analysis easier: lightweight collectors, artifact parsers, timeline builders, and triage helpers focused on AI-assisted developer environments. Attendees will leave with a practical artifact map, telemetry checklist, monitoring considerations, and investigation ideas for developer workstations that may serve as an initial access path into the software supply chain.

DFIR Track

11:10AM - 11:35AM EDT

In-Person & Virtual

Presented by

Ashwin Patil

Principal Security Researcher at Microsoft

Hunting OAuth Token Theft: Detecting Modern Identity Attacks Before They Become Breaches

Identity has become one of the most targeted attack surfaces in modern enterprises. Instead of stealing passwords or deploying malware, attackers increasingly obtain valid OAuth access tokens and reuse them to move through SaaS applications and cloud environments. Unfortunately, many organizations lack the telemetry and detection logic needed to identify token abuse before it results in account compromise.

This session demonstrates how defenders can hunt for OAuth token theft and replay using identity provider logs, API telemetry, cloud audit logs, and endpoint evidence. Through realistic attack scenarios—including token replay, bearer token theft, and OAuth redirect abuse—attendees will learn how to build hunting hypotheses, identify meaningful indicators, and create practical detections.

The presentation includes example KQL and Sigma detections, recommended logging sources, ATT&CK mappings, and a reusable hunting playbook that attendees can adapt to Microsoft Entra ID, Okta, Google Workspace, and other identity platforms.

Threat Hunting Track

11:10AM - 11:35AM EDT

In-Person & Virtual

Presented by

Bhaumik Shah

Founder and Chief Security Consultant at SecurifyAI

Lost in the Logs: Navigating the Binary Format of the Apple Unified Log

Speaker: Alexander Holcomb

The Apple Unified Log has become a critical forensic artifact that DFIR analysts leverage when investigating compromised Apple devices. However, the binary structure format of the Unified Log is undocumented by Apple and remains a black box for many analysts and users. This forces analysts to rely on native Apple tooling. To better understand how a log message is assembled, we must understand how the log message is reconstructed from fragmented data across a system.

This talk will be a deep dive into the binary structure of the Apple Unified Log format and a walkthrough of the three binary components of the Unified Log. We will discuss each binary file format and how each component leverages each other in order to assemble a full log message. In addition, the talk will discuss some challenges that may be encountered when parsing the log formats.

Finally this talk will discuss a cross-platform, open-source Rust library designed to parse the Apple Unified Log files.

DFIR Track

11:35AM - 12:00PM EDT

In-Person & Virtual

The Last Mile of Threat Hunting: Using LLM Agents to Execute and Refine Hunts at Scale

Speaker: Luis Garcia

Hypothesis-driven hunting is often presented as a process of generating hypotheses and translating them into hunt queries. In practice, the most difficult part begins after the query runs. A single hunt can return thousands or tens of thousands of events, leaving analysts to manually baseline activity, identify outliers, and determine which findings deserve investigation.

This presentation shares lessons learned from building and deploying a production LLM-agent workflow focused on hunt execution and analysis. Rather than stopping at query generation, the system assists analysts throughout the investigation process by iteratively refining hunt results, building behavioral baselines, clustering similar activity, identifying anomalies, and surfacing the most promising leads for human review.

The talk walks through a complete threat hunting case study, showing how an initial broad hunt query evolves through multiple stages of automated analysis. Attendees will see how specialized agents perform result triage, compare activity against environmental baselines, identify unusual patterns, generate investigative pivots, and summarize findings with supporting evidence. The workflow is demonstrated against real security telemetry and production hunting scenarios.

The presentation also examines the challenges encountered in practice, including weak baselines, hallucinated conclusions, inconsistent results across model versions, and analyst trust. We discuss the safeguards implemented to ensure findings remain explainable, evidence-based, reproducible, and subject to analyst validation.

Attendees will leave with a practical framework for using LLM agents to augment hunt execution, reduce manual triage effort, and help analysts focus on the most suspicious activity without sacrificing transparency or investigative rigor.

Threat Hunting Track

11:35AM - 12:00PM EDT

In-Person & Virtual

From Social Engineering to Asset Recovery: A Real-World Cross-Border Investigation into Cryptocurrency Theft

Speakers: Abdalla Jamal Alshamsi & Captain Ahmad Tariq Almrashda

Cyber-enabled financial crimes rarely begin with sophisticated malware or advanced intrusion techniques. More often, they begin with trust. This presentation examines a real-world investigation that started with a carefully crafted social engineering campaign and phishing attack that successfully deceived the victim, resulting in unauthorized access to accounts, compromise of digital assets, and the theft of cryptocurrency.

What initially appeared to be a routine phishing incident rapidly evolved into a complex, multi-stage investigation involving digital forensics, attack reconstruction, blockchain intelligence, asset tracing, legal coordination, and international cooperation.

The session follows the complete investigative timeline from the initial victim report through the final operational outcome. Attendees will learn how investigators reconstructed the attacker’s actions, identified key forensic artifacts, analyzed compromise indicators, and established a timeline of events from the initial social engineering contact to the unauthorized transfer of digital assets.

The presentation will demonstrate how technical evidence collected from compromised systems, transaction records, and digital artifacts was correlated to identify investigative leads and support attribution efforts. Particular focus will be placed on the challenges investigators faced while tracing stolen cryptocurrency through multiple transfers intended to obscure ownership, frustrate analysis, and delay recovery efforts.

Attendees will also gain insight into the operational realities of cryptocurrency investigations, including evidence preservation, blockchain analysis methodologies, attribution challenges, cross-border information sharing, and the integration of forensic findings into judicial processes.

The investigation ultimately resulted in the identification of the suspect, the freezing of criminally controlled digital assets, the recovery of assets associated with the offense, the issuance of judicial orders, and the successful apprehension of a suspect located outside the victim’s jurisdiction through established legal procedures. Rather than presenting a success story alone, this session provides a practical and repeatable investigative framework for DFIR practitioners, cybercrime investigators, analysts, and law enforcement professionals.

Attendees will leave with actionable methodologies for investigating cryptocurrency-enabled crimes, tracing digital assets, supporting recovery operations, and transforming technical findings into operational outcomes.

DFIR Track

12:00PM - 12:25PM EDT

In-Person & Virtual

Confidently Wrong : Feedback Loops of False Positives in AI-Augmented Threat Hunting

Speaker: Molly Correia Modern SOC and threat hunting workflows are increasingly augmented by large language models for alert triage and hypothesis generation, yet these systems remain unreliable in practice. They frequently produce confident but incorrect classifications, including overestimating routine activity as active compromise, mislabeling benign scheduled operations as command-and-control behavior, and incorrectly mapping post-exploitation or vulnerability exploitation stages.

For example, legitimate enterprise behavior such as backup jobs running at 2 AM may be incorrectly interpreted as beaconing or data exfiltration patterns. These hallucinations increase analyst workload, inflate false positives, and introduce operational risk by obscuring real threats.

This presentation introduces a self-correcting AI threat hunting pipeline designed to address these limitations through structured feedback, institutional context modeling, and persistent learning. A key extension of this work is the concept of *institutional benchmark engineering*, where organizations define their own environment-specific ground truth. This allows security teams to encode what “normal behavior” looks like in their own infrastructure, for example, scheduled backups, patch deployments, or batch ETL jobs so that these are not misclassified as malicious activity.

The system is evaluated on a custom benchmark of 30 realistic security scenarios derived from publicly documented attack patterns and detection use cases.(CISA KEV and NVD CVE) Each scenario includes structured ground truth for severity, recommended response action, and MITRE-aligned attack categorization.

A baseline evaluation using Gemini-2.0-Flash achieved 33.3% accuracy, revealing significant weaknesses across severity classification, response action selection, and attack categorization. The system then applies a persistent learning loop that captures failures, stores them as structured JSON memory, and generates targeted course corrections that evolve the prompt across iterations.

Following a single learning cycle, performance improved to 96.7% accuracy, reducing failures from 20 scenarios to a single remaining error. The loop injected 43 targeted corrections addressing systematic issues such as DDoS over-classification, infiltration mislabeling, and incorrect remediation actions.

The session walks through the full architecture, including benchmark design, institutional baseline modeling, failure-memory construction, automated correction generation, and iterative prompt evolution. It also demonstrates how organizations can continuously refine detection intelligence by embedding site-specific operational context directly into evaluation benchmarks, thereby reducing hallucinations without model retraining.

Attendees will receive:

•⁠ ⁠Full open-source Python implementation of the persistent learning loop

•⁠ ⁠Framework for building institutional SOC benchmarks tailored to enterprise environments

•⁠ ⁠Benchmark generation pipeline with KEV-derived scenarios

•⁠ ⁠Failure-memory and correction injection patterns for self-improving SOC workflows

•⁠ ⁠Prompt engineering strategies for deploying self-correcting AI in security operations

This talk provides practical methods for detection engineers and threat hunters to systematically evaluate, contextualize, and improve the reliability of AI-driven security decisions before operational deployment.

Threat Hunting Track

12:00PM - 12:25PM EDT

In-Person & Virtual

To Be Announced

DFIR Track

12:25PM - 12:50PM EDT

In-Person & Virtual

When 100% Coverage Isn't Enough: Measuring Effective Detection Coverage

Speaker: Antonia Feffer

Traditional MITRE ATT&CK coverage assessments typically treat detections as binary, asking only whether an analytic exists for a given technique. This approach fails to capture whether a detection is resilient to implementation variations, adversary evasion, or alternative attack paths. As part of MITRE CTID's Summiting the Pyramid initiative, the presenters developed an "effective coverage" calculator that evaluates detection quality by measuring how well analytics perform across multiple technique implementations and how robust they remain against adversarial evasion opportunities.

This session will present the research methodology behind the calculator, including the introduction and analysis of ATT&CK technique implementations, robustness and precision evaluation, and the framework used to quantify effective detection coverage. The presenters will demonstrate the calculator tool against a variety of Elastic and Sigma analytics and apply it to a real-world 2020 intrusion case study, showing how the methodology identifies gaps that traditional ATT&CK coverage metrics fail to expose and helps prioritize improvements to existing detections. Attendees will leave with a practical framework for evaluating detection effectiveness beyond binary ATT&CK coverage, access to the effective coverage calculator, and guidance for applying the methodology to improve detection engineering and threat hunting programs within their own environments.

Threat Hunting Track

12:25PM - 12:50PM EDT

In-Person & Virtual

WORKSHOP |Protocol-SIFT and Linux Investigations: Speeding Things Up and Validating Results

DFIR Track

02:00PM - 04:00PM EDT

In-Person

Presented by

Jim Clausing

Technical Consultant, Network Security Architect at AT&T

WORKSHOP | Ransomware Hands-On Workshop

Ransomware Track

02:00PM - 04:00PM EDT

In-Person

WORKSHOP | Threat Hunting Hands-On Workshop

Threat Hunting Track

02:00PM - 04:00PM EDT

In-Person

Tournament: DFIR NetWars

Registration:

All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
Not taking a course? You can register for NetWars without taking a course below.

About DFIR NetWars: Focused on digital forensics, incident response, threat hunting, and malware analysis, this tool-agnostic approach covers everything from low-level artifacts to high-level behavioral observations.

Computer Requirements: Laptop/desktop-based

Processor: 64-bit, x86, 2.0 GHz+
Memory: 16GB (8GB is possible with reduced performance)
HD: 200GB+ Free, and approximately 50GB download of evidence files and virtual machines
Interface: USB 3.0 | Type-A or dongle with Type-A
Operating System: Windows 10 or later, Mac OS 10.15 or later, Linux
Virtualization Software: VMware - Students are expected to either provide their own forensics tools or use the local VMware VM tools that we provide.

Extra Requirements: Files downloads are required to participate.

Recommended For: Experienced Digital Forensic Analysts, Forensic Examiners, Media Exploitation Examiners, Malware Analysts, Incident Responders, Threat Hunters, Security Operations Center (SOC) Analysts, Law Enforcement Officers, Federal Agents, Detectives, and Cyber Crime Investigators.

Disciplines: Digital Forensics, Incident Response.

Example Topics:

Threat Hunting
Malware Analysis
SIFT Workstation
Media Exploitation
Artifact Analysis
Rapid Triage
Malicious attacks
Network traffic analysis
Reverse engineering and debugging
Intrusion detection

Interactive Scenario: As a DFIR specialist, you are provided with evidence files from a series of mysterious compromised systems and conventional computing environments. Your mission? Use your DFIR skills to shed light on attack vectors, indicators of compromise, and other evidence needed to resolve the incident.

06:30PM - 09:30PM EDT

In-Person & Virtual

NetWars Standalone Registration

Tournament: DFIR NetWars

Registration:

All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
Not taking a course? You can register for NetWars without taking a course below.

Computer Requirements: Laptop/desktop-based

Processor: 64-bit, x86, 2.0 GHz+
Memory: 16GB (8GB is possible with reduced performance)
HD: 200GB+ Free, and approximately 50GB download of evidence files and virtual machines
Interface: USB 3.0 | Type-A or dongle with Type-A
Operating System: Windows 10 or later, Mac OS 10.15 or later, Linux
Virtualization Software: VMware - Students are expected to either provide their own forensics tools or use the local VMware VM tools that we provide.

Extra Requirements: Files downloads are required to participate.

Disciplines: Digital Forensics, Incident Response.

Example Topics:

Threat Hunting
Malware Analysis
SIFT Workstation
Media Exploitation
Artifact Analysis
Rapid Triage
Malicious attacks
Network traffic analysis
Reverse engineering and debugging
Intrusion detection

06:30PM - 09:30PM EDT

In-Person & Virtual

Netwars Standalone Registration

Hilton Arlington Rosslyn The Key

Hotel Special Rates and Reservations

A special discounted rate of $289.00 S/D plus applicable taxes will be honored based on space availability. A limited number of Government Per Diem rooms at the prevailing rate are available with proper ID.

SANS attendees will receive a discounted parking rate of $20 per day. Parking is discounted to $30 per overnight with in-and-out privileges for attendees who book in the SANS room block

These rates include Internet in your room and are only available through Tuesday, September 22, 2026.

Book A Regular Reservation Book A Per Diem Government Reservation

3 Reasons To Stay At The Event Venue

Ultimate Convenience
Eliminate the hassle of daily commutes and wasted travel time. You’ll have everything you need—from your training to dining and amenities—all in one centralized, convenient location.
Seamless Networking Opportunities
Stay where the action is! Maximize your chances to connect with fellow cybersecurity professionals and industry leaders—from impromptu conversations in the lobby to exclusive after-hours events.
All Day, All Event Access
SANS live training events include bonus sessions exclusively at the venue. Staying on-site ensures you won’t miss these opportunities to grow your network and engage with peers beyond the conference agenda.

Three people smiling during a meeting in an office

More Information

SANS attendees will receive a discounted parking rate of $20 per day. Parking is discounted to $30 per overnight with in-and-out privileges for attendees who book in the SANS room block. Venue Parking Details - Self-Parking: $45 per day Rate listed is prevailing and subject to change. Alternative Parking Options - SANS recommends researching nearby parking facilities for more options. Popular parking apps that can help you locate and reserve space during your training: SpotHero, ParkMobile, and ParkWhiz. Distance from Nearby Airport - Reagan Washington National Airport (DCA): Approximately 4.0 miles.

SEC536: Adversarial AI - Penetration Testing AI Systems

SANS DFIR Summit & Training 2026

Share

All of DFIR. One Event.

What Attendees Say

Summit Highlights

Highly Technical Talks and Sessions

One-of-a-Kind Networking with the Top Minds in DFIR

Summit@Night

Solutions Expo Hall

World-Class SANS Courses

Register

Summit and Course Registration

Summit Registration Only

Courses

GIAC Certifications

Extra 4 Months of Course Access

NetWars Tournament

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

Quick view

FOR563: Applied AI for Digital Forensics and Incident Response: Leveraging Local Large Language Models

Quick view

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

Quick view

FOR500: Windows Forensic Analysis

Quick view

FOR585: Smartphone Forensic Analysis In-Depth

Quick view

FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

Quick view

FOR518: Mac and iOS Forensic Analysis and Incident Response

Quick view

FOR578: Cyber Threat Intelligence

Quick view

FOR498: Digital Acquisition and Rapid Triage

Quick view

FOR509: Enterprise Cloud Forensics and Incident Response

Quick view

FOR608: Enterprise-Class Incident Response & Threat Hunting

Quick view

FOR528: Ransomware and Cyber Extortion

Quick view

FOR577: LINUX Incident Response and Threat Hunting

Quick view

FOR589: Cybercrime Investigations

Quick view

FOR478: Cyber Threat Intelligence Foundations

Quick view

Thank You To Our Sponsors

Schedule

Summit Dates

Training Dates

Breakfast, Credential Pick Up & Solutions Expo

Opening Remarks

Keynote | Anti-Forensics in the Idaho Murders Case: The Traces He Left Trying to Leave No Trace

Keynote | Title To Be Announced

In Conversation: Heather Barnhart & Jason Higley

Break & Track Transition

When Google Sends the Phish: Abusing Legitimate Infrastructure and Sender Identity in a Live Vishing Attack

Stopping Ransomware Before Encryption - Threat Hunting Lessons from a Real-World Identity Attack

OneDrive - Let's Take This Offline

Threat Hunting and Ransomware Resilience in Modern OT and Manufacturing Environments

From Siri to Siri AI: Exploring The Curious Case of Apple and Its Intelligence

Breathes and Shuffles: Exposing Heuristic Blindspots in EDR Ransomware Detection Engines

To Be Announced

Proving What Left the Building: Reconstructing Rclone Exfiltration from Memory Evidence

Lunch & Solutions Expo

Evidence Isn't on Disk: A DFIR Playbook for Compromised MCP Servers and AI Coding Agents

Unpatched, Unsegmented, Unprepared: A Ransomware Recovery Insight

From Alert to Intent: Investigating Insider Data Exfiltration Across USB, Email, and Cloud in Enterprise DFIR

To Be Announced

To Be Announced

To Be Announced

Break

WORKSHOP | Threat Hunting and Criminal Infrastructure

To Be Announced

Ransomware Hands-On Workshop | Title To Be Announced

WORKSHOP | Operation Phantom Thread

SANS Social

Breakfast & Solutions Expo