This hands-on workshop walks through how security teams can simulate real-world attacks and investigate them using a SIEM. Participants will deploy a multi-stage threat using SCYTHE, then pivot into Splunk to hunt for indicators of compromise across endpoint telemetry. The session focuses on practical techniques for identifying malicious behavior, mapping activity to the MITRE ATT&CK framework and strengthening threat detection workflows.
Attendees should join to:
-
Learn how to deploy and simulate multi-stage threats using SCYTHE
-
Understand how endpoint telemetry from Sysmon and Windows logs reveals attacker activity
-
See how detected behavior can be mapped to MITRE ATT&CK techniques for clearer analysis
-
Discover how custom dashboards and queries in Splunk support more effective threat hunting
We look forward to your participation and hope you’ll gain practical experience detecting and investigating sophisticated cyber threats in a SIEM environment.