March 8 2020 – DFIR ADA

Def Con 919 Presents – March Meeting – Digital Forensics Incident Response Against the Dark Arts


Morrisville, NC
790 Ethical Hackers

DEF CON Group (DCG) for the RTP/RDU/Raleigh/Durham/Chapel Hill area of North Carolina.  You’ll get the most out of being a member if you are able to attend in person meetings….

Check out this Meetup Group →

ALL levels of experience, skill, and interest are welcome and encouraged to join us. You do not have to be a “hacker” to attend.

Class Summary:
Ever wondered what it is like being a security analyst? Here is your chance. DC919 will be hosting an exciting 4-hour class taught by @Mr_Forensics and @S3curityN. This class will arm students with the knowledge needed to identify malicious threats and characterize their behavior.

This class is open to anyone that would like to participate or observe. If planning to participate in the hands-on learning objectives, please ensure to follow the preparation instructions below. Phishing and malicious spam attacks continue to pose a significant risk in today’s cyber threat landscape. Using forensic and malware analysis fundamentals, this class is designed to teach students how to analyze malicious downloaders, phishing emails & malicious spam.

For returning students, we will have updated content and malware samples; to include a new capstone.

Upon successful class completion, students will be able to:
– Build analysis skills that leverage complex scenarios and improve comprehension.
– Demonstrate an understanding of forensic fundamentals used to analyze an email.
– Use open-source information to collect and analyze threat actor data; identify indicators of compromise, and demonstrate how to pivot on that information.
– Demonstrate how to analyze a malicious downloader; to include but not limited to debugging and deobfuscation.
– Participate in a hand to keyboard combat capstone. Students will be given a malicious sample and demonstrate how to analyze.

Student Instructions:

Student Download Link:

1. Students will be required to download two virtual machines. In regards to the downloaded virtual machines, these should be imported into your virtual machine software and ready before the start of class.

2. If any additional technical support is needed, the instructors will make themselves available online; via email to

Sunday, March 8, 1:45 PM

• 2 PM Forensic Introduction
• 6 PM Open Discussion at Raleigh Times Bar