This workshop focuses on one of the most persistent challenges in modern offensive security: getting your tools past EDRs, antivirus products, and the increasingly suspicious collection of endpoint controls standing between you and a successful operation.

We will explore how existing offensive security tools can be configured and modified when their default versions are detected. Rather than changing random parts and hoping the alerts disappear, we will examine practical ways to identify what is being detected, understand why it is being detected, and determine which parts of the tool actually need to change.

The workshop is built around hands-on testing against real, currently used EDR and antivirus products in a controlled environment. Participants will compare how different products respond to the same techniques, learn why an approach that works perfectly against one product may immediately upset another, and examine how configuration changes and targeted modifications can affect detection.

We will also look at modern approaches for reducing the time required to produce a working solution, including automation and modular tooling. Tuoni will be used as a practical example of how an offensive security framework can provide configuration and modification options for adapting tooling to different environments.

By the end of the workshop, participants should have a more systematic understanding of endpoint detection evasion, the ability to diagnose likely reasons why a tool is being detected, and a practical methodology for adapting offensive tooling.

- Type of the workshop: technical
- Level: upper intermediate
- Prior knowledge necessary: Being comfortable in software development area is quite needed and some experience in red teaming or similar area helps to set things to better context.
- Personal equipment necessary: Please bring a laptop capable of comfortably running at least two x64 virtual machines simultaneously, with the following environments prepared:

- Development VM: A Windows VM with sufficient CPU and RAM to run Visual Studio and compile projects comfortably. Install the latest stable version of Visual Studio, including the tools required for C++ and C# development, along with LLVM/Clang compiler support.

- Test VM(s): One or more Windows VMs with your preferred EDR or antivirus solution installed and active, ready to test the bypass techniques developed during the workshop. Multiple VMs with different security products are welcome.

Step into the cybersecurity leadership team experience! This high-energy, interactive workshop throws your team into realistic, high-stakes scenarios where every decision counts. You’ll face evolving cyber threats, manage crises under pressure, and make strategic choices that impact your organization’s security, reputation, and future.

Your mission? Build and sustain the strongest Security Culture. From employee training to incident response, every move you make will shape your score, and prove your leadership. Can you balance risk, budget, and impact while staying ahead of attackers? Will your strategy hold when the pressure is on? Join us and find out.

Outcomes and Learnings:
- Understand the core responsibilities of cybersecurity leadership in high-stakes environments.
- Learn to prioritise risk and allocate resources effectively.
- Gain insights into building resilient security cultures.
- Experience real-time decision-making under pressure.

Intended Audience:
Security leaders, aspiring CISOs, and professionals who want to sharpen their strategic cybersecurity leadership skills.

Type of the workshop: educational
Level: intermediate
Prior knowledge necessary: No prior experience required, just a sharp mind and a collaborative spirit.
Personal equipment necessary: A mobile device (laptop, tablet or smartphone) and a stable internet connection is required to take part in the workshop.

MISP (Malware Information Sharing Platform) ir viena no plaši izmantotajām atvērtā pirmkoda platformām kiberdraudu informācijas apkopošanai, strukturēšanai, analīzei un apmaiņai.

Šajā praktiskajā darbnīcā dalībnieki iepazīs, kas ir MISP, kāpēc tas tiek izmantots un kā ar to efektīvi strādāt ikdienas kiberdrošības un incidentu reaģēšanas darbā. Soli pa solim apskatīsim platformas galvenās funkcijas, draudu informācijas ievadi un strukturēšanu, Events un Attributes, indikatoru (IoC) izmantošanu, informācijas korelāciju, kā arī iespējas dalīties ar draudu informāciju ar citiem uzticamiem partneriem un kopienām.

Darbnīcas laikā dalībnieki ne tikai iegūs teorētisku priekšstatu par MISP, bet arī praktiski izmēģinās darbu ar platformu, lai saprastu, kā no atsevišķiem tehniskiem indikatoriem un novērojumiem veidot vērtīgu un izmantojamu kiberdraudu izlūkošanas informāciju.

Semināra veids: izglītojošs
Līmenis: iesācējiem
Iepriekšējas zināšanas: Darbnīca galvenokārt ir domāt auditorijai, kas ir kaut ko dzirdējuši par MISP, bet vēlas uzzināt vairāk.
Nepieciešamais aprīkojums: Portatīvais dators

Most endpoint tools are built for the calm before the attack. This hands-on workshop is about the other moment - when ransomware is already encrypting files, security controls have been tampered with, and your EDR/XDR has gone quiet.

Participants work directly with GRYPHON, a European-developed endpoint agent built by the Research & Development team at IstroSec - an organisation that handles severe cybersecurity incidents for a living. GRYPHON Ransomware Protection Toolkit is not another EDR/; it is the complementary layer in a defense-in-depth strategy for workstations and servers, engineered to keep protecting critical infrastructure when other controls fail - including on isolated, air-gapped, and legacy systems that modern tools no longer support.

Across the session we build protection from the endpoint up and then put it under attack:

- Behavioural, signature-free detection : a purpose-built transformer model paired with inspectable, explainable rules - that stops never-before-seen ransomware in real time, at kernel level, before encryption completes;

- Protected, tamper-proof backups and automatic on-endpoint recovery that undo damage in place - not "restore from an off-site copy in three days";

- Defense against advanced techniques: LOLBins, process injection, credential theft, and security-control evasion;

- Live incident response: endpoint isolation, remote process and file inspection, and response scripting - executed inside an already-compromised environment.

We also address the operational reality that decides whether a tool survives in a government or critical-infrastructure environment: deployment options, integration with existing EDR/XDR and SIEM stacks (YARA, API), and day-two administration - policies, exceptions, compatibility, and auditability.

Participants leave with an honest, practical picture of where this layer adds real resilience, where its limits are, and how to sustain it operationally over the long term.

Prior knowledge necessary: Basic windows/AD attack mechanisms, scripting; basic Linux scripting. IR experience beneficial.<< /br>
Personal equipment necessary: No tech requirements needed.

When investigating security incidents, incident responders are often confronted with malicious files, e.g. web shells, scripts, payloads, or ransomware samples.

Understanding what these files do is critical for scoping an incident, identifying attacker capabilities, and determining the appropriate response.

This hands-on workshop provides a practical introduction to malware analysis from an incident response perspective. Participants will learn a structured approach to analysing suspicious files, extracting relevant information, and understanding attacker behavior without prior reverse engineering expertise.

Through guided exercises, we will analyze real-world malware samples using freely available tools. By the end of the workshop, participants will know how to triage malicious files efficiently and understand how malware analysis supports effective incident response.

Type of the workshop: technical
Level: beginner
Personal equipment necessary: Participants should bring a laptop capable of running virtual machines.

Before the workshop, please install:
- VMware Workstation Pro or VirtualBox
- REMnux virtual machine (https://remnux.org/)
- FlareVM (https://github.com/mandiant/flare-vm)