SANS DFIR Summit & Training 2026

Summit: Oct 15–16 Training: Oct 17–22
Duration:
14 Courses
12 CPEs (Summit Only)
1 NetWars Tournament
English

Hilton Arlington Rosslyn The Key & Virtual (ET)

1900 Fort Myer Dr, Arlington, VA, 22209

In-person exclusive

The keynote “The Idaho Murders: College Nightmare” is available exclusively to in-person Summit attendees and will not be broadcast, recorded, or shared.

Rapid Triage Engaged

T-MINUS

Days

Hrs

Min

Sec

The disk is gone. The RAM is gone. What's left is a trace, and a story someone tried to erase.

One examiner sits between the breach and the truth — reconstructing what happened, artifact by artifact.

Every log is a witness. Every timestamp, a lead.

THIS IS DFIR. SANS DFIR SUMMIT & TRAINING 2026.

Save

$1,000

Off

Offer ends in

Days

Hrs

Min

DFIR26_1000

Save my spot

SANS DFIR Summit justification letter preview

Need approval to attend?

Download a ready-to-use letter that makes the case to your manager.

Download the letter

Technical Talks and Keynotes
Real investigations, emerging research, and practical DFIR tradecraft.
Hands-On Workshops
Practice today’s DFIR tools and investigative techniques.
Connect with the DFIR Community
Compare approaches and tackle hard problems with fellow practitioners.

Jump to:

Speakers
Schedule
Registration / Courses
Advisory Board / Summit Chairs
Sponsors
Hotel

Featured Speakers

Heather Barnhart

DFIR Curriculum Lead and Head of Faculty

SANS Institute

Keynote

Idaho Murders Digital Evidence

Jason Higley

Founder and Principal

SG Consulting

Keynote

Digital Evidence Exposes Deception

Jenn Gile

Co-Founder

OpenSourceMalware

Threat Hunting Track

DPRK Developer Identity Attacks

Aidan Holland

Senior Security Researcher

Censys

DFIR Track

ClickFix and Odyssey Stealer

Erblind Morina

Principal Incident Response Consultant

IBM X-Force

DFIR Track

Cloud and AI Hijacking

Michał Sołtysik

Cybersecurity Consultant

Michał Sołtysik CyberWave

Ransomware Track

Ransomware EDR Blind Spots

Summit: Oct 15-16 | Training: Oct 17-22 | Summit Co-Chairs: Ovie Carroll, Mari DeGrazia and Ryan Chapman

All of DFIR. One Event.

Digital Forensics | Incident Response | Ransomware | Threat Hunting

Slide 1 of 2
Slide 2 of 2

If You Think You Know the SANS DFIR Summit, Think Again.

The 2026 SANS DFIR Summit brings Digital Forensics, Incident Response, Ransomware, and Threat Hunting together in one powerful DFIR event. Experience highly technical talks, real investigations, expanded hands-on workshops, practical resources, and direct access to experienced practitioners.

In-person attendees will also go beyond the Netflix documentaries with exclusive case-study keynotes featuring evidence and investigative insights from The Idaho Murders: College Nightmare and A Toxic Love Story. Then, continue building your skills with 14 SANS courses offered immediately after the Summit.

Join us October 15–16 in Arlington, Virginia, for the complete in-person experience, or attend Live Online for access to select talks.

NOTE: The Day 1 special case-study keynotes, and featured discussion are available exclusively to in-person attendees and will not be broadcast or shared publicly.

Can’t Join Us in Arlington? Attend the Summit Live Online for Free.

Access select talks, connect with fellow attendees through the interactive Slack chat, and receive first access to approved recordings and decks.

What Attendees Say

Slide 1 of 4
I've been to large events where I only saw 3 people out of 3,000 that I knew. I came to the DFIR Summit, and saw 30 out of 300. This is like a good family reunion, a time to rejuvenate and reconnect with my "tribe."
Frank McClain
Slide 2 of 4
The DFIR Summit never disappoints and is still the #1 DFIR event. As a leader, it allows me to keep a pulse on cutting-edge research and to meet folks.
Brad Garnett
Slide 3 of 4
For new and veterans alike, the info you get from the Summits are second to none. This was my first Summit! I can't wait for the next one!
Mike Lentoski
Slide 4 of 4
This Summit creates a ton of new ideas on how to improve our incident response processes.
Andy V.

Schedule

Summit Dates

Thursday, Oct 15th - Friday, October 16th

Training Dates

Saturday, October 17th - Thursday, October 22nd

Showing 23 of 46

Filter by:

Select day:

Breakfast, Credential Pick Up and Solutions Expo

Check in at the registration desk to pick up your Summit credentials, then enjoy a hot breakfast, freshly brewed coffee, and a selection of hot teas before the day’s sessions begin. Be sure to visit the Solutions Expo to meet our Summit sponsors and explore the tools, services, and resources they offer.

08:00AM - 09:00AM EDT

In-Person

Opening Remarks

08:45AM - 09:00AM EDT

In-Person

Presented by

Ovie Carroll

Director at DOJ Cybercrime Lab

Mari DeGrazia

Certified Instructor at SANS Institute

Ryan Chapman

Team Lead, Managed Threat Hunting at Palo Alto Networks

Keynote | Anti-Forensics in the Idaho Murders Case: The Traces He Left Trying to Leave No Trace

NOTE: The Day 1 special case-study keynotes, and featured discussion are available exclusively to in-person attendees and will not be broadcast or shared publicly.

Every contact leaves a trace. BK was a criminology graduate student who appeared to have left behind a remarkably limited digital footprint surrounding the November 13, 2022 murders of four University of Idaho students. For nearly a month, the investigation continued without an arrest. DNA evidence recovered from the crime scene ultimately helped lead law enforcement to BK, while surveillance footage of a vehicle provided another critical piece of the investigative puzzle. But the digital evidence told its own story.

In this keynote, Heather will dive into the digital logs, artifacts, and other evidence that helped investigators reconstruct events, establish connections, and build their case against BK. Through a DFIR lens, she will explore how seemingly small digital traces can become powerful pieces of a much larger investigation, and demonstrate why, even when someone appears to have minimized their digital footprint, the evidence left behind can still reveal a compelling story.

09:00AM - 09:35AM EDT

In-Person

Presented by

Heather Barnhart

DFIR Curriculum Lead and Head of Faculty at SANS Institute

Keynote | From Lilith to Truth: The Digital Evidence that Put the Badge Behind the Keyboard

NOTE: The Day 1 special case-study keynotes, and featured discussion are available exclusively to in-person attendees. Only Jason Higley's presentation will be recorded and made available to all registered in-person and virtual attendees after the Summit on the Summit access page.

Every message has a sender, a recipient, and can have any number of service providers in between. Evidence can be found in all of these places; you just have to go looking. Ian Diaz was a Deputy U.S. Marshal who, with his wife Angela Connell, engaged in an elaborate scheme to create an online persona called "Lilith" that he used to frame his ex-fiancée Michelle Hadley for crimes she did not commit.

Diaz was a savvy criminal who used his law enforcement training, VPNs, and encrypted messaging apps. He destroyed evidence by deleting accounts and wiping devices. But to carry out a scheme like this on digital devices, you have to be perfect. Diaz wasn't.

In this keynote, Jason will discuss the forensic investigation and digital evidence that exposed Diaz's scheme and secured his conviction. He will show how the case was made, not with a single smoking gun, but by the accumulation of small, individual pieces of evidence — the grains of sand that eventually tipped the scale and established Diaz's guilt.

09:35AM - 10:10AM EDT

In-Person

Presented by

Jason Higley

Founder and Principal at SG Consulting

In Conversation: Heather Barnhart and Jason Higley

NOTE: The Day 1 special case-study keynotes, and featured discussion are available exclusively to in-person attendees and will not be broadcast or shared publicly.

Following their back-to-back keynotes, Heather Barnhart and Jason Higley return to the stage to compare insights from their investigations, discuss the role digital evidence played in uncovering the truth, and ask questions of one another. The conversation will conclude with questions from the audience.

10:10AM - 10:30AM EDT

In-Person

Presented by

Heather Barnhart

DFIR Curriculum Lead and Head of Faculty at SANS Institute

Jason Higley

Founder and Principal at SG Consulting

Break and Track Transition

Step away from the morning sessions to recharge and connect with fellow attendees. Enjoy coffee, tea, assorted soft drinks and juices, fresh fruit, and a featured snack.

10:30AM - 10:50AM EDT

In-Person

When Google Sends the Phish: Abusing Legitimate Infrastructure and Sender Identity in a Live Vishing Attack

Vishing attacks targeting Google accounts have grown more sophisticated — not by breaking authentication systems, but by weaponizing them. This talk presents a forensic case study of a real, coordinated attack that combined display-name header spoofing with deliberate abuse of Google's account recovery notification infrastructure to deliver a fully authenticated, DKIM-signed Google security alert directly to the victim's inbox.

The attack began with a phone call impersonating Google Support, followed by two precisely timed emails. The first was a spoofed phishing lure — appearing as "support@google" while originating from attacker-controlled infrastructure at case-priority.com, relayed through MailChannels and Hostinger, with SPF passing on the envelope sender while the visible From header pointed to a non-existent domain. The second required no spoofing at all: the attacker added the victim's address as a recovery contact on a throwaway Gmail account, then triggered account changes — causing Google's own servers to send a legitimate security alert to the victim's inbox. The contrast between the two emails is forensically significant and operationally underappreciated.

Attendees will learn to identify SPF alignment failure behind a passing SPF result, read SMTP relay chains to surface attacker infrastructure, and distinguish display-name spoofing from envelope spoofing in raw headers. The talk concludes with a MITRE ATT&CK mapping of the full attack chain, header-level IOCs, and hardening recommendations for Google Workspace environments that DFIR practitioners can implement immediately.

DFIR Track

10:50AM - 11:15AM EDT

In-Person & Virtual

Presented by

Dr. Mahesh Kalappattil

Sr. Principal Engineer at Palo Alto Networks

Stopping Ransomware Before Encryption - Threat Hunting Lessons from a Real-World Identity Attack

Every ransomware investigation begins long before encryption. Success depends on recognizing the seemingly ordinary activity attackers use to establish access, move through an environment, and position themselves before launching the final stage of an attack. Using a real-world incident involving Fusion Computing, presenters reconstruct an identity-driven intrusion that was identified and contained before ransomware could be deployed.

Attendees will follow the investigation from an initial social engineering phone call through PowerShell execution, command-and-control activity, and living-off-the-land techniques that initially blended with legitimate administrative behavior.

Bryson demonstrate how endpoint telemetry, identity signals, and forensic artifacts were used to reconstruct the attack timeline, validate attacker activity, identify the evidence that mattered most, and prioritize containment decisions before encryption could occur. The session also examines how the observed techniques map to the MITRE ATT&CK framework, highlighting practical opportunities to improve visibility into identity-based attacks and strengthen threat hunting workflows.

Participants will leave with practical hunting techniques for detecting identity-driven intrusions, investigative approaches for validating attacker activity, and recommendations for strengthening ransomware detection before encryption begins.

Ransomware Track

10:50AM - 11:15AM EDT

In-Person & Virtual

Presented by

Bryson Byrd

Cybersecurity Advisor at Huntress

OneDrive - Let's Take This Offline

Microsoft OneDrive Offline Mode stores significantly more than synchronized files. Modern versions of the client cache data from Outlook, Microsoft Teams, and SharePoint, creating a rich source of forensic evidence that is often absent from traditional acquisition and analysis workflows. Investigators who understand these artifacts can recover valuable context about user activity even when cloud access is unavailable.

This session provides a deep technical examination of OneDrive Offline Mode artifacts and demonstrates how to identify and analyze files associated with email, calendar events, meeting invitations, Teams chats, and SharePoint data. The presentation explains where these artifacts are stored, how they relate to one another, and techniques for reconstructing user activity across Microsoft 365 services.

The session also examines OneDrive's Optical Character Recognition (OCR) metadata, showing how text extracted from images and documents can become valuable investigative evidence while also introducing privacy and security considerations. Attendees will learn how OCR data is stored, what information can be recovered, and the implications for incident response, insider threat investigations, and enterprise data protection.

Using real artifacts and practical demonstrations, attendees will gain a repeatable methodology for locating, parsing, and correlating OneDrive Offline Mode data. They will leave with actionable techniques that can be immediately incorporated into forensic collections, artifact triage, and Microsoft 365 investigations.

DFIR Track

11:15AM - 11:40AM EDT

In-Person & Virtual

Presented by

Brian Maloney

Lead IT Security Analyst at Thrivent Financial

Unpatched, Unsegmented, Unprepared: A Ransomware Recovery Insight

When a manufacturing organization with two physical sites was compromised through an unpatched FortiGate 60E firewall running a vulnerable FortiOS 7.2.2 build affected by CVE-2022-42475, alongside a set of end-of-life Windows Server 2012 hosts, the incident response team uncovered far more than encrypted files. The environment had a fully flat network with switch loopbacks, no DHCP failover, and backups that had never been audited, meaning entire servers were missing from the backup set without anyone knowing.

This session walks through the full incident lifecycle: initial access through the unpatched firewall and legacy servers, confirmed data exfiltration alongside encryption, forensic preservation through full host imaging and triage collection before any remediation began, and the decision to pursue a decryptor rather than risk an estimated 50 percent data loss across the environment, including Active Directory.

Attendees will see the exact hardening checklist used across both sites, covering network containment, Active Directory and Kerberos resets, GPO and credential audits, and EDR plus anti-ransomware deployment, along with the specific gaps in the client's prior security posture that allowed the incident to happen in the first place.

This talk is built for both technical responders who want the operational detail and less technical attendees who need to understand how a single unpatched device cascades into a two-site recovery effort.

Ransomware Track

11:15AM - 11:40AM EDT

In-Person & Virtual

Presented by

Javid Bakhtiani

Incident and Response Recovery Engineer at Rethinking Consulting Services (RTCS)

Sarah Bukhari

President at Rethinking Consulting Services (RTCS)

Who Put Holes in my Cheese: The Swiss Cheese Model of Root Cause Analysis

The most common root cause analysis seen in cases such as ransomware or business email compromise focuses mainly on the human aspect; a user clicked on a phishing link or opened a malicious document. From here, DFIR professionals close out the incident and move back into the day to day operations. This approach leaves a lot of unanswered questions;

what vulnerabilities were exploited, was there a process breakdown, how did factors such as identify and access management and EDR bypass play into this incident? Answering these questions requires a dedicated methodology and model for incident responders to properly identify preexisting conditions and failures so that future incident can be presented.

In this presentation, Gerard Johansen will be providing an overview of the Swiss Cheese Model of Root Cause Analysis. This model examines the various factors that aligned for an incident to occur. Instead of examining digital evidence for a single point of failure, this model looks at the entire chain of events, and identified how the holes in existing processes and configurations lead to the compromise.

This talk will examine the following high level topics:

Overview of the Swiss Cheese Model of Root Cause Analysis: To provide a solid background, this section will examine the rationale behind the Swiss Cheese Model and provide background on how the model can be used for incident root cause analysis.
Active Failures vs. Latent Conditions: The two main components of the model examine how active failures, or failures due to human action or inaction can combine with latent conditions such as weak authentication mechanisms that align, allowing threat actors to exploit these components.
Aligning Digital Forensics collection and analysis for root cause: There are a range of artifacts from malware analysis to full incident timelines that provide the best data for this type of root cause analysis. Additional focus will be on aligning this model with the overall incident response lifecycle.
How to look at key data point and find the slices with holes so that process, people and technology controls can be better aligned to prevent similar incident in the future.

DFIR Track

11:40AM - 12:05PM EDT

In-Person & Virtual

Presented by

Gerard Johansen

Principal at IR Proactive

Breathes and Shuffles: Exposing Heuristic Blindspots in EDR Ransomware Detection Engines

Modern Endpoint Detection and Response (EDR) platforms heavily publicize their ability to block ransomware through real-time behavioral correlation, file-system telemetry, and API hooking. However, these detection layers rely on predictable heuristic metrics, such as high-frequency cryptographic API calls and linear directory traversing.

This presentation demonstrates how progressive structural changes can completely blind enterprise defenses without changing the operational outcome of a simulation. Through an iterative, 12-stage analysis of a purpose-built evaluation agent, we map exactly how signature scanners and behavioral engines fail when confronted with execution-delay jitter, directory-walk elimination, and user-space stream transforms.

We will reveal how shifting from standard API frameworks (like .NET CryptoStream) to custom, user-mode byte manipulation (ProcessFileStealth) easily neutralizes static heuristics. Furthermore, we demonstrate how avoiding recursive directory loops via flat enumeration techniques undercuts an EDR's correlation logic. Attendees will walk away with concrete data on engine blind spots and practical testing methodology to validate their own defensive posture against low-and-slow execution vectors.

Ransomware Track

11:40AM - 12:05PM EDT

In-Person & Virtual

Presented by

Michał Sołtysik

Cybersecurity Consultant at Michał Sołtysik CyberWave

From Drained Wallet to Threat Actor: A DFIR Investigation into ClickFix and Odyssey Stealer

Odyssey is a Malware-as-a-Service platform, and that changes how DFIR works. Developers host the infrastructure; affiliates pay for access and run their own campaigns. The affiliate who set the trap is a different actor from the operators running the backend, and attribution requires untangling both. This talk shows how.

Using forensic artifacts on the endpoint, network telemetry, and internet-wide scan data to identify the affiliate, map the full C2 fleet, and trace the platform's lineage from AMOS through Poseidon to Odyssey.

The case that gets us there: a user reports their cryptocurrency wallet has been drained. The Ledger Live app on their Mac "looked totally normal." Working a real incident from first call to final attribution, we trace Odyssey Stealer -- a macOS infostealer -- from the hidden LaunchDaemon on the victim's machine all the way back to the threat actor who ran the campaign. The path runs through a trojanized Ledger app, a cleartext password cached in a dotfile, a ClickFix fake CAPTCHA page the victim visited two weeks before the theft, and a polished React admin panel hosted on ten C2 servers across Europe and Russia.

Attendees leave with a concrete forensic artifact reference for Odyssey infections, a repeatable methodology for hunting MaaS C2 infrastructure from a single known host, and a clear-eyed picture of what "attribution" means when you're investigating a criminal SaaS.

DFIR Track

12:05PM - 12:30PM EDT

In-Person & Virtual

Presented by

Aidan Holland

Senior Security Researcher at Censys

Proving What Left the Building: Reconstructing Rclone Exfiltration from Memory Evidence

"What data was taken?" is one of the first questions legal counsel asks during a ransomware engagement, and in most cases, it's the hardest question to answer. Rclone has become the de facto exfiltration tool used by ransomware affiliates: it's free, flexible, and quiet. Analysts typically fall back on firewall logs for a byte count however, this doesn’t tell us what has been taken.

This session demonstrates how to turn a memory image, which can be paired with a packet capture, into an inventory of exfiltrated files. It dissects what rclone leaves in memory, including execution artifacts, command line arguments, and the config file. These details include the deobfuscated remote location, which reveals the destination service, the account, and the master key. From the packet capture, the tool carves the encrypted uploaded blobs, collects the exact file sizes, and then correlates them with the memory artifacts, source directory listings, and file sizes. This session shows why capture timing affects what you can collect: account keys, file encryption keys, and transport keys. During this session, a free tool that automates this and formats the output for executives and legal counsel to help drive notification decisions as well as the limitations of this tool.

Ransomware Track

12:05PM - 12:30PM EDT

In-Person & Virtual

Presented by

Jason Trapp

Assistant Manager at McGrathNicol

Lunch and Solutions Expo

Join your fellow Summit attendees for a delicious lunch and an opportunity to connect. After lunch, visit the Solutions Expo to meet our Summit sponsors and explore the tools, services, and resources they offer.

12:30PM - 01:20PM EDT

In-Person

Evidence Isn't on Disk: A DFIR Playbook for Compromised MCP Servers and AI Coding Agents

In July 2025, Check Point Research disclosed MCPoison (CVE-2025-54136, CVSS 7.2), a flaw in Cursor IDE (versions ≤ 1.2.4) where the Model Context Protocol trust model bound approval to an MCP server's name rather than its command or arguments. An attacker commits a benign .cursor/rules/mcp.json to a shared repository; a developer approves it once; the attacker later swaps in a reverse shell that runs silently on every project open — persistent RCE with no second prompt.

A companion flaw, CurXecute (CVE-2025-54135, CVSS 8.6), reached the same outcome through prompt injection that wrote to ~/.cursor/mcp.json and executed even after the user rejected the change.

These two incidents expose the problem this session tackles: when the acting entity is an AI agent, the authentication event is legitimate, the spawning process is the expected runtime, and the action falls within the agent's granted permissions so conventional EDR timelines show nothing anomalous, and the triggering instruction frequently lives only in ephemeral prompt context that does not survive default log retention.

The session reproduces both CVEs live on an isolated host, then contrasts their forensic footprints: MCPoison leaves recoverable on-disk evidence (git history of the config, file modification times, file-integrity-monitoring hits), while the prompt-injection path leaves almost nothing once the session closes. From that contrast the presenter derives a NIST-mapped incident-response playbook for agentic systems what to preserve before containment, how to triage runtime-escape versus privilege-boundary-escape versus reasoning-compromise incidents, and how to instrument MCP tool-call telemetry so the originating instruction is captured as evidence rather than lost.

Attendees leave with the lab build (vulnerable and patched configs), a forensic-artifact collection checklist for MCP and agent incidents, file-integrity-monitoring and detection logic for mcp.json tampering, and an open-source telemetry wrapper that records agent tool calls and their originating context in a retention-safe format.

DFIR Track

01:20PM - 01:45PM EDT

In-Person & Virtual

Presented by

Samuel Addington

AI Researcher and Professor at California State University Long Beach

Christopher Earl

California State University San Bernardino

WORKSHOP | Finding Answers Fast – Extracting Knowledge From the Noise

Today more than ever, we are faced with the daunting task of protecting our environment and stopping attacks. At the same time, the adversary is getting smarter and more effective by the day. Given the plethora and disparity of attack surfaces, it can be a daunting task just trying to figure out how and where to get the artifacts from that will answer our questions.

Indeed, the very security inherent in devices today means that location, extraction, and parsing are no longer straightforward. Couple this with the data set sizes an analyst is faced with, and we quickly see that we need a different approach. This workshop will provide knowledge and hands-on training and guidance on collecting, extracting, and understanding the most important artifacts from a range of data repositories from RAM to storage to the Internet of Things. The goal is to take the analyst from data seizure to actionable intelligence in minutes, rather than the hours and sometimes days that it has traditionally taken.

01:20PM - 05:40PM EDT

In-Person

Presented by

Kevin Ripa

President at The Grayson Group of Companies

From Alert to Intent: Investigating Insider Data Exfiltration Across USB, Email, and Cloud in Enterprise DFIR

Enterprise data exfiltration rarely presents as a clear, high-confidence alert. Instead, investigators must determine whether observed activity reflects legitimate business use or policy-violating or malicious behavior using incomplete and often ambiguous telemetry. This session presents real-world DFIR investigations involving insider-driven data movement across removable media, email, and cloud channels, where initial detections alone were insufficient to determine risk or intent.

The talk examines multiple investigation patterns observed in enterprise environments, including long-duration accumulation of data to removable media, burst exfiltration events where most transfers occur within a short timeframe (such as hours preceding user termination), and multi-channel movement combining USB transfers, email forwarding to personal accounts, and cloud-sharing activity.

Additional scenarios include misuse of legitimate access (where data aligns with a user’s role but is accessed or transmitted outside expected context) and repeated low-volume transfers designed to evade threshold-based detections. Attendees will follow the investigation sequence used to expand alerts into full-scope cases, including correlating endpoint telemetry such as DeviceFileEvents for removable media activity, email telemetry such as EmailEvents and attachment metadata, and identity signals related to account activity and user lifecycle changes. The session demonstrates how investigators perform historical lookbacks, validate data sensitivity through targeted sampling, and establish behavioral baselines to identify anomalies in volume, timing, and access patterns.

The presentation highlights a critical limitation in traditional DFIR workflows: activity-based detections alone cannot distinguish between legitimate use and data exfiltration without contextual and behavioral analysis. To address this, the session introduces a repeatable investigation methodology that includes classification of exfiltration patterns (slow accumulation, burst transfer, and multi-channel movement), a correlation framework linking endpoint, email, and cloud telemetry, and a decision model for assessing user intent in ambiguous scenarios.

Attendees will leave with practical, directly applicable outputs, including an investigation checklist for multi-channel data movement, behavioral indicators for identifying suspicious activity, and detection and correlation approaches that can be adapted within platforms such as Microsoft Defender XDR or similar environments.

DFIR Track

01:45PM - 02:10PM EDT

In-Person & Virtual

Presented by

Justin Price

Director of Threat Detection and Response at Johnson & Johnson

Rakesh Kumar Narsingoju

Lead Managed Services Engineer at Deloitte

Squidoor - Dissecting A Sophisticated Multi-Platform Malware Used By A Chinese APT

This talk will delve into a highly sophisticated Chinese APT campaign, tracked as CL-STA-0049, that has been targeting governments, defense, telecommunication, education and aviation sectors in Southeast Asia and South America since at least March 2023. This campaign demonstrates a high level of complexity, utilizing a multi-stage attack chain and employing advanced evasion techniques to bypass traditional security measures.

At the heart of this operation lies "Squidoor", an advanced backdoor exemplifying evolving state-sponsored tactics. This sophisticated backdoor features both Windows and Linux versions, employing an unprecedented array of 10 different C2 communication methods, including rarely seen techniques like abusing Outlook for C2 communication.

In the presentation, we will first share the different TTPs the threat actor used to gain access to the victim network and deliver the "Squidoor" malware.

Second, we will provide a thorough and detailed technical malware analysis of the "Squidoor" malware. We will begin with the execution flow of the malware involving LOLBAS and shellcode. Next, we will dive into the 10 different C2 communication methods Squidoor is able to utilize and explain how they work. And finally we will touch upon Squidoor's different capabilities and encryption protocols it's utilized as part of the c2 communication.

We will end the presentation with giving the audience practical ways to hunt for the Squidoor malware. By the end of the talk, attendees will gain a unique glimpse into the inner working of sophisticated Chinese APT tooling and operations.

DFIR Track

02:10PM - 02:40PM EDT

In-Person & Virtual

Presented by

Tom Fakterman

Senior Threat Researcher at Palo Alto Networks

Lior Rochberger

Principal Threat Researcher at Palo Alto Networks

Break and Solutions Expo

Step away from the afternoon sessions to recharge and connect with fellow attendees. Enjoy coffee, tea, assorted soft drinks and juices, fresh fruit, and a featured snack. Be sure to visit the Solutions Expo to meet our Summit sponsors and explore the tools, services, and resources they offer.

02:35PM - 03:00PM EDT

In-Person

WORKSHOP | Operation Phantom Thread: Tracing the Attacker from First Foothold to Final Exfil

An international consulting firm detects suspicious outbound traffic from a financial analyst’s workstation. Initial alerting suggests unauthorized access to internal document repositories. As the investigation begins, incident response uncovers signs of a coordinated intrusion campaign affecting multiple hosts across the network.

Over the course of this instructor-guided simulation, attendees will step into the role of a response team working through a multi-phase intrusion. The case begins with initial access via a malicious backdoor, escalates to persistence and credential abuse, and culminates in lateral movement and data exfiltration.

Analysts will be given evidence files and access to all affected systems, and they’ll work to reconstruct the full attack chain, identify compromised accounts, and map the attacker’s path across the enterprise.

Learning Objectives:

By the end of this simulation, attendees will be able to:

Identify common forensic artifacts linked to initial access and payload execution
Reconstruct attacker behavior across hosts using log data, timeline artifacts, and file system activity
Recognize signs of persistence, privilege escalation, and lateral movement using free tools
Trace data staging and exfiltration techniques, including use of covert channels
Correlate attacker actions to understand timing, objectives, and impact
Practice a structured investigation flow that mirrors real-world incident response operations using free, open-source tools and investigative frameworks

03:00PM - 05:00PM EDT

In-Person

Presented by

Carlos Cajigas

Chief Technology Officer at Covert Bit

WORKSHOP | Threat Hunting and Criminal Infrastructure

03:00PM - 05:00PM EDT

In-Person

Presented by

Conan Beach

Special Agent at U.S. Government

Summit Social

After a full day of DFIR insights, take the Summit experience to new heights at the SANS FIND EVIL Evening Social, hosted at The View with panoramic views of Washington, DC. Enjoy FIND EVIL-themed drinks, food, and a few other surprises we’re keeping under wraps as you connect with fellow attendees, speakers, and SANS experts.

05:30PM - 07:30PM EDT

In-Person

Breakfast and Solutions Expo

Check in at the registration desk to pick up your Summit credentials, then enjoy a hot breakfast, freshly brewed coffee, and a selection of hot teas before the day’s sessions begin.

08:00AM - 09:00AM EDT

In-Person

Opening Remarks

09:00AM - 09:10AM EDT

In-Person & Virtual

Presented by

Ovie Carroll

Director at DOJ Cybercrime Lab

Ryan Chapman

Team Lead, Managed Threat Hunting at Palo Alto Networks

Mari DeGrazia

Certified Instructor at SANS Institute

Keynote | To Be Announced

09:10AM - 09:50AM EDT

In-Person & Virtual

Rogue VM Chronicles: Forensic Reconstruction of a Scattered Spider Intrusion

Traditional endpoint detection and response (EDR) agents are powerful, but what happens when threat actors bypass them entirely by spinning up their own unmanaged systems within your hypervisor? Unit 42 investigated a complex intrusion where the notorious threat group Scattered Spider (aka Muddled Libra, UNC3944) did exactly that. nd older Outlook versions on Reddit.

After leveraging social engineering to gain administrative credentials, the threat actors accessed the victim's VMware vSphere portal, created an unmanaged rogue virtual machine, and utilized it as an operational beachhead to conduct actions on objectives.

Fortunately, the security team terminated the attackers' access before they could delete the rogue VM, leaving behind a highly valuable forensic record. This presentation delivers a forensic reconstruction of Scattered Spider’s active playbook built directly from the artifacts recovered from that beachhead system. We will walk through the exact 15-hour timeline, detailing the group's living-off-the-land tradecraft and distinct troubleshooting behaviors.

Attendees will learn the technical mechanics of:

• Establishing persistence using an SSH tunnel hosted in an attacker-controlled AWS S3 bucket.

• Disabling and powering down virtualized domain controllers via vSphere, mounting their VMDK disks, and copying the NTDS.dit database and SYSTEM registry hive to decrypt and harvest domain-wide credential hashes.

• Executing Active Directory enumeration tools, and specifically targeting various computing services to map critical infrastructure.

• Navigating SaaS cloud databases and attempting to exfiltrate sensitive Outlook PST files via the S3 Browser tool.

We will also analyze the threat actor's real-time struggles documented in their browser history: searching Bing for how to bypass blocked file-sharing sites, troubleshooting Outlook speed issues, and researching how to find older Outlook versions on Reddit.

09:50AM - 10:30AM EDT

In-Person & Virtual

Presented by

Cuong Dinh

Consulting Director at Palo Alto Networks - Unit 42

Justin De Luna

Senior Consultant at Palo Alto Networks - Unit 42

Break and Track Transition

Step away from the morning sessions to recharge and connect with fellow attendees. Enjoy coffee, tea, assorted soft drinks and juices, fresh fruit, and a featured snack.

10:30AM - 10:50AM EDT

In-Person & Virtual

The Invoice Is the Payload: Incident Response for Cloud Cryptojacking and LLMjacking

Ransomware is bad, but at least you get choices. Pay, do not pay, restore from backup, call the FBI. Bad options, but options. Cloud and AI hijacking does not work like that. There is no decryptor, nobody to negotiate with, no wallet to trace. The attacker gets what they came for, the provider gets paid, and you get the invoice.

Hijacking other people's machines is not new, but what it is worth has changed. In the 2000s it was sabotage and botnets. By the 2020s it was crypto mining, stealing compute to mine coins. Now it is AI: a stolen cloud key buys frontier model access, and that is not just a bill, it is free R&D. The most interesting buyers are the ones who cannot get it legitimately, actors under sanctions or export controls who now have a way to rent capability they are embargoed from buying.

I respond to these for a living. I will walk two anonymized cases and what they cost: a GCP cryptojacking job off a leaked service account that ran into the tens of thousands in hours, and an LLMjacking case on a stolen key that reached six figures before anyone noticed. For a small company either one is not a dispute, it is the end of the business. Then the harder question: as defenders we are failing at this, and I will be specific about why, what the response actually looks like when there is no host and no malware to grab, and the GCP, AWS and Azure cheat sheet you can take back to the SOC.

DFIR Track

10:45AM - 11:10AM EDT

In-Person & Virtual

Presented by

Erblind Morina

Principal Incident Response Consultant at IBM X-Force

How North Korea Pays its Bills by Creating a Human Botnet

In 2026, DPRK campaign "PolinRider" compromised over 6,000 GitHub repos and 2,100 individuals by weaponizing trusted developer identities and workflows. It represents the industrialized next phase of Contagious Interview, turning crypto-theft hiring scams into a persistent pipeline that converts individual developer compromises into mass software supply-chain propagation.

Our research indicates many victims didn't just get hit once and recover. Rather, a meaningful subset remained compromised or became re-compromised over time, giving DPRK a long-lived pool of developer endpoints, credentials, and GitHub identities. This talk covers how PolinRider works and core detection engineering techniques you can use to hunt and identify these attacks.

Threat Hunting Track

10:45AM - 11:10AM EDT

In-Person & Virtual

Presented by

Jenn Gile

Co-Founder at OpenSourceMalware

Tracing AI-Assisted IDEs: Forensic Artifacts, Agent Observability, and Software Supply Chain Risk

AI-assisted IDEs and coding tools are becoming part of normal developer workstation activity, but most DFIR playbooks still treat them as background applications rather than forensic evidence sources. This creates a visibility gap during developer compromise and software supply chain investigations: responders may see file changes, package installs, or repository activity, but miss the local session context, tool activity, workspace state, and configuration that explain how those actions occurred.

This session presents a DFIR-focused artifact study of AI-assisted developer environments such as VS Code with GitHub Copilot, Cursor, Claude Code, Codex, and related IDE- or terminal-based coding assistants. The research will compare the local traces these tools can leave behind, including session history, workspace context, prompts, tool outputs, command traces, debug logs, extension data, configuration files, local observability records, and repository-level instructions. It will also examine how these environments intersect with traditional attacker targets such as environment variables, API tokens, SSH keys, credential stores, package-manager credentials, and source-control authentication.

The talk will map these artifacts to realistic investigation scenarios involving malicious packages, suspicious editor or extension behavior, credential exposure, risky activities, and downstream CI/CD abuse. The focus will be on how these artifacts can be parsed, what important activity can already be observed through current EDR, endpoint, editor, source-control, and enterprise telemetry, and where visibility gaps remain for responders investigating compromised developer workstations.

The session will also discuss open-source tooling opportunities to make this analysis easier: lightweight collectors, artifact parsers, timeline builders, and triage helpers focused on AI-assisted developer environments. Attendees will leave with a practical artifact map, telemetry checklist, monitoring considerations, and investigation ideas for developer workstations that may serve as an initial access path into the software supply chain.

DFIR Track

11:10AM - 11:35AM EDT

In-Person & Virtual

Presented by

Ashwin Patil

Principal Security Researcher at Microsoft

Hunting OAuth Token Theft: Detecting Modern Identity Attacks Before They Become Breaches

Identity has become one of the most targeted attack surfaces in modern enterprises. Instead of stealing passwords or deploying malware, attackers increasingly obtain valid OAuth access tokens and reuse them to move through SaaS applications and cloud environments. Unfortunately, many organizations lack the telemetry and detection logic needed to identify token abuse before it results in account compromise.

This session demonstrates how defenders can hunt for OAuth token theft and replay using identity provider logs, API telemetry, cloud audit logs, and endpoint evidence. Through realistic attack scenarios—including token replay, bearer token theft, and OAuth redirect abuse—attendees will learn how to build hunting hypotheses, identify meaningful indicators, and create practical detections.

The presentation includes example KQL and Sigma detections, recommended logging sources, ATT&CK mappings, and a reusable hunting playbook that attendees can adapt to Microsoft Entra ID, Okta, Google Workspace, and other identity platforms.

Threat Hunting Track

11:10AM - 11:35AM EDT

In-Person & Virtual

Presented by

Bhaumik Shah

Founder and Chief Security Consultant at SecurifyAI

Lost in the Logs: Navigating the Binary Format of the Apple Unified Log

The Apple Unified Log has become a critical forensic artifact that DFIR analysts leverage when investigating compromised Apple devices. However, the binary structure format of the Unified Log is undocumented by Apple and remains a black box for many analysts and users. This forces analysts to rely on native Apple tooling. To better understand how a log message is assembled, we must understand how the log message is reconstructed from fragmented data across a system.

This talk will be a deep dive into the binary structure of the Apple Unified Log format and a walkthrough of the three binary components of the Unified Log. We will discuss each binary file format and how each component leverages each other in order to assemble a full log message. In addition, the talk will discuss some challenges that may be encountered when parsing the log formats.

Finally this talk will discuss a cross-platform, open-source Rust library designed to parse the Apple Unified Log files.

DFIR Track

11:35AM - 12:00PM EDT

In-Person & Virtual

Presented by

Alexander Holcomb

Principal Consultant at Mandiant | Google Cloud

The Last Mile of Threat Hunting: Using LLM Agents to Execute and Refine Hunts at Scale

Hypothesis-driven hunting is often presented as a process of generating hypotheses and translating them into hunt queries. In practice, the most difficult part begins after the query runs. A single hunt can return thousands or tens of thousands of events, leaving analysts to manually baseline activity, identify outliers, and determine which findings deserve investigation.

This presentation shares lessons learned from building and deploying a production LLM-agent workflow focused on hunt execution and analysis. Rather than stopping at query generation, the system assists analysts throughout the investigation process by iteratively refining hunt results, building behavioral baselines, clustering similar activity, identifying anomalies, and surfacing the most promising leads for human review.

The talk walks through a complete threat hunting case study, showing how an initial broad hunt query evolves through multiple stages of automated analysis. Attendees will see how specialized agents perform result triage, compare activity against environmental baselines, identify unusual patterns, generate investigative pivots, and summarize findings with supporting evidence. The workflow is demonstrated against real security telemetry and production hunting scenarios.

The presentation also examines the challenges encountered in practice, including weak baselines, hallucinated conclusions, inconsistent results across model versions, and analyst trust. We discuss the safeguards implemented to ensure findings remain explainable, evidence-based, reproducible, and subject to analyst validation.

Attendees will leave with a practical framework for using LLM agents to augment hunt execution, reduce manual triage effort, and help analysts focus on the most suspicious activity without sacrificing transparency or investigative rigor.

Threat Hunting Track

11:35AM - 12:00PM EDT

In-Person & Virtual

Presented by

Luis Garcia

Incident Response Expert at Sygnia

From Social Engineering to Asset Recovery: A Real-World Cross-Border Investigation into Cryptocurrency Theft

Cyber-enabled financial crimes rarely begin with sophisticated malware or advanced intrusion techniques. More often, they begin with trust. This presentation examines a real-world investigation that started with a carefully crafted social engineering campaign and phishing attack that successfully deceived the victim, resulting in unauthorized access to accounts, compromise of digital assets, and the theft of cryptocurrency.

What initially appeared to be a routine phishing incident rapidly evolved into a complex, multi-stage investigation involving digital forensics, attack reconstruction, blockchain intelligence, asset tracing, legal coordination, and international cooperation.

The session follows the complete investigative timeline from the initial victim report through the final operational outcome. Attendees will learn how investigators reconstructed the attacker’s actions, identified key forensic artifacts, analyzed compromise indicators, and established a timeline of events from the initial social engineering contact to the unauthorized transfer of digital assets.

The presentation will demonstrate how technical evidence collected from compromised systems, transaction records, and digital artifacts was correlated to identify investigative leads and support attribution efforts. Particular focus will be placed on the challenges investigators faced while tracing stolen cryptocurrency through multiple transfers intended to obscure ownership, frustrate analysis, and delay recovery efforts.

Attendees will also gain insight into the operational realities of cryptocurrency investigations, including evidence preservation, blockchain analysis methodologies, attribution challenges, cross-border information sharing, and the integration of forensic findings into judicial processes.

The investigation ultimately resulted in the identification of the suspect, the freezing of criminally controlled digital assets, the recovery of assets associated with the offense, the issuance of judicial orders, and the successful apprehension of a suspect located outside the victim’s jurisdiction through established legal procedures. Rather than presenting a success story alone, this session provides a practical and repeatable investigative framework for DFIR practitioners, cybercrime investigators, analysts, and law enforcement professionals.

Attendees will leave with actionable methodologies for investigating cryptocurrency-enabled crimes, tracing digital assets, supporting recovery operations, and transforming technical findings into operational outcomes.

DFIR Track

12:00PM - 12:25PM EDT

In-Person & Virtual

Presented by

Abdalla Jamal Alshamsi

Detective Officer at Sharjah Police

Ahmed Belhay

First Lieutenant at Sharjah Police

Confidently Wrong : Feedback Loops of False Positives in AI-Augmented Threat Hunting

Modern SOC and threat hunting workflows are increasingly augmented by large language models for alert triage and hypothesis generation, yet these systems remain unreliable in practice. They frequently produce confident but incorrect classifications, including overestimating routine activity as active compromise, mislabeling benign scheduled operations as command-and-control behavior, and incorrectly mapping post-exploitation or vulnerability exploitation stages.

For example, legitimate enterprise behavior such as backup jobs running at 2 AM may be incorrectly interpreted as beaconing or data exfiltration patterns. These hallucinations increase analyst workload, inflate false positives, and introduce operational risk by obscuring real threats.

This presentation introduces a self-correcting AI threat hunting pipeline designed to address these limitations through structured feedback, institutional context modeling, and persistent learning. A key extension of this work is the concept of *institutional benchmark engineering*, where organizations define their own environment-specific ground truth. This allows security teams to encode what “normal behavior” looks like in their own infrastructure, for example, scheduled backups, patch deployments, or batch ETL jobs so that these are not misclassified as malicious activity.

The system is evaluated on a custom benchmark of 30 realistic security scenarios derived from publicly documented attack patterns and detection use cases.(CISA KEV and NVD CVE) Each scenario includes structured ground truth for severity, recommended response action, and MITRE-aligned attack categorization.

A baseline evaluation using Gemini-2.0-Flash achieved 33.3% accuracy, revealing significant weaknesses across severity classification, response action selection, and attack categorization. The system then applies a persistent learning loop that captures failures, stores them as structured JSON memory, and generates targeted course corrections that evolve the prompt across iterations.

Following a single learning cycle, performance improved to 96.7% accuracy, reducing failures from 20 scenarios to a single remaining error. The loop injected 43 targeted corrections addressing systematic issues such as DDoS over-classification, infiltration mislabeling, and incorrect remediation actions.

The session walks through the full architecture, including benchmark design, institutional baseline modeling, failure-memory construction, automated correction generation, and iterative prompt evolution. It also demonstrates how organizations can continuously refine detection intelligence by embedding site-specific operational context directly into evaluation benchmarks, thereby reducing hallucinations without model retraining.

Attendees will receive:

•⁠ ⁠Full open-source Python implementation of the persistent learning loop

•⁠ ⁠Framework for building institutional SOC benchmarks tailored to enterprise environments

•⁠ ⁠Benchmark generation pipeline with KEV-derived scenarios

•⁠ ⁠Failure-memory and correction injection patterns for self-improving SOC workflows

•⁠ ⁠Prompt engineering strategies for deploying self-correcting AI in security operations

This talk provides practical methods for detection engineers and threat hunters to systematically evaluate, contextualize, and improve the reliability of AI-driven security decisions before operational deployment.

Threat Hunting Track

12:00PM - 12:25PM EDT

In-Person & Virtual

Presented by

Molly Correia

Security Engineer Consultant at Con Edison

The AI Question: What Does It Mean for DFIR?

Join Mari DeGrazia and Ovie Carroll for a lively discussion about the promise and potential pitfalls of AI in DFIR, moderated by Heather Barnhart. Bringing different perspectives to this important question, the panelists will explore where AI can strengthen investigations, where it may introduce new risks, and what its growing role could mean for the future of the field.

DFIR Track

12:25PM - 12:50PM EDT

In-Person & Virtual

Moderated by

Heather Barnhart

DFIR Curriculum Lead and Head of Faculty at SANS Institute

Presented by

Ovie Carroll

Director at DOJ Cybercrime Lab

Mari DeGrazia

Certified Instructor at SANS Institute

When 100% Coverage Isn't Enough: Measuring Effective Detection Coverage

Traditional MITRE ATT&CK coverage assessments typically treat detections as binary, asking only whether an analytic exists for a given technique. This approach fails to capture whether a detection is resilient to implementation variations, adversary evasion, or alternative attack paths. As part of MITRE CTID's Summiting the Pyramid initiative, the presenters developed an "effective coverage" calculator that evaluates detection quality by measuring how well analytics perform across multiple technique implementations and how robust they remain against adversarial evasion opportunities.

This session will present the research methodology behind the calculator, including the introduction and analysis of ATT&CK technique implementations, robustness and precision evaluation, and the framework used to quantify effective detection coverage. The presenters will demonstrate the calculator tool against a variety of Elastic and Sigma analytics and apply it to a real-world 2020 intrusion case study, showing how the methodology identifies gaps that traditional ATT&CK coverage metrics fail to expose and helps prioritize improvements to existing detections. Attendees will leave with a practical framework for evaluating detection effectiveness beyond binary ATT&CK coverage, access to the effective coverage calculator, and guidance for applying the methodology to improve detection engineering and threat hunting programs within their own environments.

Threat Hunting Track

12:25PM - 12:50PM EDT

In-Person & Virtual

Presented by

Antonia Feffer

Senior Cybersecurity Engineer at The MITRE Corporation

Lunch and Solutions Expo

12:50PM - 02:00PM EDT

In-Person

WORKSHOP |Protocol-SIFT and Linux Investigations: Speeding Things Up and Validating Results

02:00PM - 04:00PM EDT

In-Person

Presented by

Jim Clausing

Technical Consultant, Network Security Architect at AT&T

WORKSHOP | Hands-on Malicious Script Analysis for Ransomware Response

A large majority of ransomware incidents involve both obfuscated scripts and Cobalt Strike. PowerShell reigns supreme as the most common type of obfuscated script found in ransomware cases. Do you know what to do should you find an obfuscated PowerShell script during response? What if you run into an obfuscated, PowerShell-based Cobalt Strike downloader?

Do you know how to decode the downloader? Do you know how to review the shellcode found multiple levels within the code structure to determine where the Cobalt Strike beacon is being hosted?

Come join SANS "FOR528: Ransomware for Incident Responders" author Ryan Chapman as he walks you through one of our FOR528 labs that shows you these very skills. You will use a virtual machine custom developed just for this workshop to review obfuscated code from real FOR528 labs. As a bonus, you will also learn how to extract the configuration from a Cobalt Strike Beacon. The better you are at performing these tasks yourself, the quicker you'll be able to derive additional TTPs and IOCs to assist in your overall response. Come learn HANDS-ON!

02:00PM - 04:00PM EDT

In-Person

Presented by

Ryan Chapman

Team Lead, Managed Threat Hunting at Palo Alto Networks

WORKSHOP | Threat Hunting Hands-On Workshop

02:00PM - 04:00PM EDT

In-Person

Presented by

David Bianco

Sydney Marrone

Head of Threat Hunting at Nebulock

Break

Step away from the afternoon workshops to recharge and connect with fellow attendees. Enjoy coffee, tea, assorted soft drinks and juices, fresh fruit, and a featured snack.

03:00PM - 03:15PM EDT

In-Person

Breakfast Reception

Enjoy a hot breakfast, freshly brewed coffee, and a selection of hot teas before the day’s classes begin.

08:00AM - 09:00AM EDT

In-Person

Tournament: DFIR NetWars

Registration:

All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
Not taking a course? You can register for NetWars without taking a course below.

About DFIR NetWars: Focused on digital forensics, incident response, threat hunting, and malware analysis, this tool-agnostic approach covers everything from low-level artifacts to high-level behavioral observations.

Computer Requirements: Laptop/desktop-based

Processor: 64-bit, x86, 2.0 GHz+
Memory: 16GB (8GB is possible with reduced performance)
HD: 200GB+ Free, and approximately 50GB download of evidence files and virtual machines
Interface: USB 3.0 | Type-A or dongle with Type-A
Operating System: Windows 10 or later, Mac OS 10.15 or later, Linux
Virtualization Software: VMware - Students are expected to either provide their own forensics tools or use the local VMware VM tools that we provide.

Extra Requirements: Files downloads are required to participate.

Recommended For: Experienced Digital Forensic Analysts, Forensic Examiners, Media Exploitation Examiners, Malware Analysts, Incident Responders, Threat Hunters, Security Operations Center (SOC) Analysts, Law Enforcement Officers, Federal Agents, Detectives, and Cyber Crime Investigators.

Disciplines: Digital Forensics, Incident Response.

Example Topics:

Threat Hunting
Malware Analysis
SIFT Workstation
Media Exploitation
Artifact Analysis
Rapid Triage
Malicious attacks
Network traffic analysis
Reverse engineering and debugging
Intrusion detection

Interactive Scenario: As a DFIR specialist, you are provided with evidence files from a series of mysterious compromised systems and conventional computing environments. Your mission? Use your DFIR skills to shed light on attack vectors, indicators of compromise, and other evidence needed to resolve the incident.

06:30PM - 09:30PM EDT

In-Person & Virtual

NetWars Standalone Registration

Tournament: DFIR NetWars

Registration:

All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
Not taking a course? You can register for NetWars without taking a course below.

Computer Requirements: Laptop/desktop-based

Processor: 64-bit, x86, 2.0 GHz+
Memory: 16GB (8GB is possible with reduced performance)
HD: 200GB+ Free, and approximately 50GB download of evidence files and virtual machines
Interface: USB 3.0 | Type-A or dongle with Type-A
Operating System: Windows 10 or later, Mac OS 10.15 or later, Linux
Virtualization Software: VMware - Students are expected to either provide their own forensics tools or use the local VMware VM tools that we provide.

Extra Requirements: Files downloads are required to participate.

Disciplines: Digital Forensics, Incident Response.

Example Topics:

Threat Hunting
Malware Analysis
SIFT Workstation
Media Exploitation
Artifact Analysis
Rapid Triage
Malicious attacks
Network traffic analysis
Reverse engineering and debugging
Intrusion detection

06:30PM - 09:30PM EDT

In-Person & Virtual

Netwars Standalone Registration

Register

Summit Registration Only

Free

$525 USD*Prices exclude applicable local taxes

In personIncludes

Talks, Presentations and Workshops
Unmatched Networking
Evening Reception
Access to Summit Exhibit Hall
Lunch and light refreshments will be provided during the event and scheduled breaks
First Access to Approved Recordings and Decks

Attend In PersonLogin to register

Free

Live onlineIncludes

Access to Select Talks
Interactive Chat on Slack
First Access to Approved Recordings and Decks

Summit and Course Registration

$995 USD

In personIncludes

Course: Live Instructor Training with Hands-on Exercises
Course: DFIR NetWars Tournament with purchase of a course
Summit: Talks, Presentations and Workshops
Summit: Unmatched Networking
Summit: Evening Reception
Summit: Access to Summit Exhibit Hall
Summit: Lunch and light refreshments will be provided during the event and scheduled breaks
Save $1,000 USD on any 4–6 day course at this Summit when you register and pay by Sept 25. Code: DFIR26_1000

Select course to Enroll

Live onlineIncludes

Course: Virtual Live Instructor Training with Hands-On Exercises
Summit: Access to Select Talks
Summit: Interactive Chat on Slack
First Access to Approved Recordings and Decks
Save $1,000 USD on any 4–6 day course at this Summit when you register and pay by Sept 25. Code: DFIR26_1000

Select course to Enroll

Important Dates

Refund Deadline:: September 28, 2026
Hotel Group Discount Deadline:: September 22, 2026

Courses

Looking for Group Purchasing? Contact Us

Showing 14 of 14

Filter by:

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

FOR508Digital Forensics and Incident Response, Artificial Intelligence

GIAC Certified Forensic Analyst
6 Days
36 CPEs
Carlos Cajigas

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR563: Applied AI for Digital Forensics and Incident Response: Leveraging Local Large Language Models

FOR563Digital Forensics and Incident Response, Artificial Intelligence

FOR509: Enterprise Cloud Forensics and Incident Response

1 Day
6 CPEs
Mari DeGrazia

Starts 19 Oct 2026 at 9:00 AM ET
$995 USD (Course)
*Prices exclude applicable local taxes

Starts 19 Oct 2026 at 9:00 AM ET
$995 USD (Course)
*Prices exclude applicable local taxes

View course details

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

FOR610Digital Forensics and Incident Response

GIAC Reverse Engineering Malware
6 Days
36 CPEs
Lenny Zeltser

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR500: Windows Forensic Analysis

FOR500Digital Forensics and Incident Response

GIAC Certified Forensic Examiner
6 Days
36 CPEs
Ovie Carroll

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR585: Smartphone Forensic Analysis In-Depth

FOR585Digital Forensics and Incident Response, Artificial Intelligence

GIAC Advanced Smartphone Forensics
6 Days
36 CPEs
Josh Hickman

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

FOR572Digital Forensics and Incident Response

GIAC Network Forensic Analyst
6 Days
36 CPEs
Philip Hagen

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR518: Mac and iOS Forensic Analysis and Incident Response

FOR518Digital Forensics and Incident Response

GIAC iOS and macOS Examiner
6 Days
36 CPEs
Sarah Edwards

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR578: Cyber Threat Intelligence

FOR578Digital Forensics and Incident Response

GIAC Cyber Threat Intelligence
6 Days
36 CPEs
Rebekah Brown

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR498: Digital Acquisition and Rapid Triage

FOR498Digital Forensics and Incident Response

GIAC Battlefield Forensics and Acquisition
6 Days
36 CPEs
Kevin Ripa

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR509: Enterprise Cloud Forensics and Incident Response

FOR509Digital Forensics and Incident Response

GIAC Cloud Forensics Responder
6 Days
36 CPEs
Megan Roddie-Fonseca

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR608: Enterprise-Class Incident Response & Threat Hunting

FOR608Digital Forensics and Incident Response

GIAC Enterprise Incident Responder
6 Days
36 CPEs
Mike Pilkington

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR528: Ransomware and Cyber Extortion

FOR528Digital Forensics and Incident Response

3 Days
24 CPEs
Ryan Chapman

Starts 17 Oct 2026 at 8:30 AM ET
$4,200 USD (Course)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$4,200 USD (Course)
*Prices exclude applicable local taxes

View course details

FOR577: LINUX Incident Response and Threat Hunting

FOR577Digital Forensics and Incident Response, Artificial Intelligence

GIAC Linux Incident Responder
6 Days
36 CPEs
Terrance Maguire

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

Starts 17 Oct 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR478: Cyber Threat Intelligence Foundations

FOR478Digital Forensics and Incident Response, Artificial Intelligence

2 Days
12 CPEs
John Doyle

Starts 20 Oct 2026 at 8:30 AM ET
$3,505 USD (Course)
*Prices exclude applicable local taxes

Starts 20 Oct 2026 at 8:30 AM ET
$3,505 USD (Course)
*Prices exclude applicable local taxes

View course details

Advisory Board

Heather Barnhart

DFIR Curriculum Lead and Head of Faculty

Heather brings 24+ years of experience supporting government agencies, defense contractors, law enforcement, and Fortune 500 companies. Her extensive case experience spans fraud investigations, crimes against children, counterterrorism, and more.

Learn more

Mattia Epifani

CEO

Mattia Epifani pioneered methodologies for extracting critical evidence from encrypted mobile ecosystems, including iOS and Apple Watch. His groundbreaking work has become foundational for law enforcement and forensic analysts worldwide.

Learn more

Jessica Hyde

Founder

Ms. Hyde is an experienced forensic examiner in both the government and commercial sectors as a contractor providing forensics services to the Department of Defense, Intelligence Community, and private sector.

Learn more

Tony Knutson

Consulting Director

Tony Knutson is Consulting Director at Palo Alto Unit 42. He is also part of the SANS OnDemand SME team.

Learn more

Allan Liska

CSIRT

Allan Liska, threat intelligence analyst at Recorded Future, has more than 15 years of experience in information security and has worked as both a security practitioner and an ethical hacker.

Learn more

Sean O'Connor

Director

Sean O’Connor is a cybersecurity professional with over 15 years of experience in intelligence, digital forensics, and threat analysis across both the private and public sectors.

Learn more

Thank You To Our Sponsors

Hilton Arlington Rosslyn The Key

Hotel Special Rates and Reservations

A special discounted rate of $289.00 S/D plus applicable taxes will be honored based on space availability. A limited number of Government Per Diem rooms at the prevailing rate are available with proper ID.

Self-parking with in and out privileges is discounted for SANS attendees at $20 per day for commuters and $30 per overnight.

These rates include Internet in your room and are only available through Friday, September 25, 2026.

Book a Regular Reservation Book a Government Per Diem Reservation

3 Reasons To Stay At The Event Venue

Ultimate Convenience
Eliminate the hassle of daily commutes and wasted travel time. You’ll have everything you need—from your training to dining and amenities - all in one centralized, convenient location.
Seamless Networking Opportunities
Stay where the action is! Maximize your chances to connect with fellow cybersecurity professionals and industry leaders - from impromptu conversations in the lobby to exclusive after-hours events.
All Day, All Event Access
SANS live training events include bonus sessions exclusively at the venue. Staying on-site ensures you won’t miss these opportunities to grow your network and engage with peers beyond the conference agenda.

Business People Shaking Hands and Smiling

Additional Information

SANS attendees will receive a discounted parking rate of $20 per day. Parking is discounted to $30 per overnight with in-and-out privileges for attendees who book in the SANS room block. Venue Parking Details - Self-Parking: $45 per day Rate listed is prevailing and subject to change. Alternative Parking Options - SANS recommends researching nearby parking facilities for more options. Popular parking apps that can help you locate and reserve space during your training: SpotHero, ParkMobile, and ParkWhiz. Distance from Nearby Airport - Reagan Washington National Airport (DCA): Approximately 4.0 miles.

SEC536: Adversarial AI - Penetration Testing AI Systems

SANS DFIR Summit & Training 2026

Share

Featured Speakers

All of DFIR. One Event.

If You Think You Know the SANS DFIR Summit, Think Again.

Can’t Join Us in Arlington? Attend the Summit Live Online for Free.

What Attendees Say

Schedule

Summit Dates

Training Dates

Breakfast, Credential Pick Up and Solutions Expo

Opening Remarks

Keynote | Anti-Forensics in the Idaho Murders Case: The Traces He Left Trying to Leave No Trace

Keynote | From Lilith to Truth: The Digital Evidence that Put the Badge Behind the Keyboard

In Conversation: Heather Barnhart and Jason Higley

Break and Track Transition

When Google Sends the Phish: Abusing Legitimate Infrastructure and Sender Identity in a Live Vishing Attack

Stopping Ransomware Before Encryption - Threat Hunting Lessons from a Real-World Identity Attack

OneDrive - Let's Take This Offline

Unpatched, Unsegmented, Unprepared: A Ransomware Recovery Insight

Who Put Holes in my Cheese: The Swiss Cheese Model of Root Cause Analysis

Breathes and Shuffles: Exposing Heuristic Blindspots in EDR Ransomware Detection Engines

From Drained Wallet to Threat Actor: A DFIR Investigation into ClickFix and Odyssey Stealer

Proving What Left the Building: Reconstructing Rclone Exfiltration from Memory Evidence

Lunch and Solutions Expo

Evidence Isn't on Disk: A DFIR Playbook for Compromised MCP Servers and AI Coding Agents

WORKSHOP | Finding Answers Fast – Extracting Knowledge From the Noise

From Alert to Intent: Investigating Insider Data Exfiltration Across USB, Email, and Cloud in Enterprise DFIR

Squidoor - Dissecting A Sophisticated Multi-Platform Malware Used By A Chinese APT

Break and Solutions Expo

WORKSHOP | Operation Phantom Thread: Tracing the Attacker from First Foothold to Final Exfil

WORKSHOP | Threat Hunting and Criminal Infrastructure

Summit Social

Breakfast and Solutions Expo

Opening Remarks

Keynote | To Be Announced

Rogue VM Chronicles: Forensic Reconstruction of a Scattered Spider Intrusion

Break and Track Transition

The Invoice Is the Payload: Incident Response for Cloud Cryptojacking and LLMjacking

How North Korea Pays its Bills by Creating a Human Botnet

Tracing AI-Assisted IDEs: Forensic Artifacts, Agent Observability, and Software Supply Chain Risk

Hunting OAuth Token Theft: Detecting Modern Identity Attacks Before They Become Breaches

Lost in the Logs: Navigating the Binary Format of the Apple Unified Log

The Last Mile of Threat Hunting: Using LLM Agents to Execute and Refine Hunts at Scale

From Social Engineering to Asset Recovery: A Real-World Cross-Border Investigation into Cryptocurrency Theft

Confidently Wrong : Feedback Loops of False Positives in AI-Augmented Threat Hunting

The AI Question: What Does It Mean for DFIR?

When 100% Coverage Isn't Enough: Measuring Effective Detection Coverage

Lunch and Solutions Expo

WORKSHOP |Protocol-SIFT and Linux Investigations: Speeding Things Up and Validating Results

WORKSHOP | Hands-on Malicious Script Analysis for Ransomware Response

WORKSHOP | Threat Hunting Hands-On Workshop

Break

Breakfast Reception

Tournament: DFIR NetWars

Tournament: DFIR NetWars

Register

Summit Registration Only

Summit and Course Registration

Courses

GIAC Certifications

Extra 120 Days of Course Access

NetWars Tournament

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

Quick view

FOR563: Applied AI for Digital Forensics and Incident Response: Leveraging Local Large Language Models

Quick view

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

Quick view

FOR500: Windows Forensic Analysis

Quick view

FOR585: Smartphone Forensic Analysis In-Depth

Quick view

FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

Quick view

FOR518: Mac and iOS Forensic Analysis and Incident Response

Quick view

FOR578: Cyber Threat Intelligence

Quick view