78th TF-CSIRT Meeting, September 2026: Stockholm: Agenda

Trainer:

• Michael Hamm, CIRCL

Forensic analysts typically rely on (semi-)automated tools to efficiently process digital evidence, perform investigations, and generate reports. These tools act as an abstraction layer between the analyst and the underlying raw data. While this significantly improves efficiency, it also introduces a dependency on the correctness and consistency of the tools' output.

If different forensic tools produce inconsistent results, generate conflicting reports for the same evidence, or if the validity of the findings is questioned, analysts must be able to verify the results independently. This requires the ability to examine the underlying raw data directly, interpret its binary representation, and understand how the reported findings are derived from the original evidence.

This training will start with a little demo. Different tools produce different results. Than we will:
1. Read a stream of Bit
2. Apply addressing to it
3. Learn to interpret values like integer, signed integer or ASCII
4. Be able to convert a little endian value into a big endian
5. Apply a data structure on the data
6. Recover data manually

At the end of the training the attendee will be able to read a MBR/BootSector and read the partition table manually.

This is a hands-on training and attendees should bring a Linux laptop to be able to perform the exercise. All standard Linux distributions like Kali Linux should be sufficient. Just the package "The Sleuth Kit" should be installed.

Trainer:

• Etienne Ladent, Kering-CERT

SOC and CSIRT teams drown in alerts, tickets, ad‑hoc notes, and half‑remembered terminal sessions. Every new Suricata hit or case review starts with rebuilding context from scratch, and most of that work is lost once the incident closes.

This workshop walks through building an AI‑assisted “second brain” for alert processing on an Ubuntu Sandbox VM, using Obsidian as the structured memory and OpenCode as the AI layer on top. Participants will connect Obsidian to OpenCode via MCP, let the model build a complete incident chain from a raw Suricata alert (intake, incident, intel, playbook, case, lessons learned), and then extend the setup with a custom AbuseIPDB tool for IP reputation enrichment.

The goal is show how a small, controllable stack can capture incident knowledge as linked notes, reuse it on the next alert, and offload repetitive triage and documentation work to AI while keeping humans in charge of decisions.

Prerequisite
The lab runs on a local VM, with an optional Docker‑based deployment path for those who prefer containerized environments. You’ll need a "fresh" Ubuntu 22.04/24.04 virtual machine with internet access and sudo/root privileges; everything else is installed during the workshop.

Trainer:

• Jens-Christian Fischer, SWITCH CERT

This half-day session puts you inside a live crisis, then moves you to the facilitator's seat. In the first part you take part in a running incident as a team: injects arrive over email, chat, social media and the press, reactive characters respond to your decisions, and the scenario branches based on what you do. You feel what a reactive exercise is like from the participant's side before you learn to run one.

In the second part we open up the game-master view of a pre-built scenario. You will see how a live run is controlled: releasing injects, steering reactive characters, handling the moments that need a human in the loop, and reading what the team is doing, all while a single facilitator keeps the room under pressure. You will take a turn driving the scenario yourself.

We will also work through the design method behind a good reactive exercise: how injects and characters are tied to participant actions, how branching and a fact-ledger keep a multi-path story consistent, and how to scope a scenario for your own team. Scenarios are currently built by us as part of the SWITCH Security Academy offering, so you leave with a design you can commission or develop together rather than author alone.

You leave with first-hand experience of a reactive exercise, practical facilitation skills, and a method for scoping crisis scenarios for your own team. Intended for CSIRT and SOC staff, incident managers and anyone who runs crisis exercises. No development experience required; bring a laptop. Numbers may be capped to keep the session hands-on.

Trainer:

• Michael Hamm, CIRCL

This training is about how to hide data on storage media, by abusing the file systems 'defect cluster' mechanism.

Many file systems still provide the feature to mark clusters, with defect sectors inside, as defect. This feature was needed, to handle storage media which come without it own controller, and avoid the operating system to try working with defect clusters.

Fraudsters can abuse this feature to hide data persistently on the storage media, as this sectors/clusters are circumvent and not used any more. typical use cases could be APT, AntiVirus circumvent or data ex-filtration.

We will explore how file systems do some of their most important activity. We will explore how this is implemented by the FAT32 file system. We will use this techniques on hands-on exercises to hide data in bad clusters And we will learn how to forensically detect such kind of data.

This is a hands-on training and attendees should bring a Linux laptop to be able to perform the exercise. All standard Linux distributions like Kali Linux should be sufficient. Just the package "The Sleuth Kit" should be installed.

Trainers:

• Dana Ludviga, CERT.LV
• Daina Ozoliņa, CERT.LV

What happens when a cyber incident stops being an IT problem and suddenly becomes everyone’s problem?

The Business Continuity Challenge is an interactive cybersecurity crisis tabletop card game designed to put your organisation to the test when a cyber incident escalates into a business crisis.

Step into the shoes of management, IT, legal and communications and work together to navigate a realistic, fast-moving cyber crisis. As the situation unfolds, you’ll face incomplete information, competing priorities, difficult decisions, and unexpected twists.

And this is not fiction. Every scenario is based on a real cyberattack that has occurred in Latvia and a real organisation that faced it. There are no made-up incidents or imaginary threats. The challenges you encounter are drawn from real events and real-world consequences.

Your mission is simple: test your readiness for the challenges organisations face when a cyber incident becomes a business crisis.

CERT.LV uses the Business Continuity Challenge as a practical training tool for organisations subject to the National Cybersecurity Law, helping them strengthen cyber resilience, test their readiness, and practise implementing business continuity and cyber risk management plans in a realistic and engaging environment.

During the workshop, we’ll also show you how the Business Continuity Challenge was created and share the source materials and files, so you can reuse and adapt the concept to create your own tabletop exercise tailored to your country, sector, organisation, or threat landscape.

Trainer:

• Thorben Jändling

Human-operated ransomware groups like Scattered Spider (UNC3944) have demonstrated that even well-funded technical defenses can be bypassed by adversaries who weaponize human trust rather than software vulnerabilities. This hands-on workshop addresses that gap through a guided Breach and Attack Simulation (BAS) set in "Fakebank," a fictitious financial institution, using Scattered Spider's real-world tactics, techniques, and procedures as the adversarial blueprint.
No prior red team experience is required — all attack steps and commands are provided for participants to execute directly into Mythic-C2, keeping the focus firmly on the defender's perspective. The simulation spans three kill chain stages: initial access via a vishing attack and C2 callback; privilege escalation exploiting CVE-2024-26169; and ransomware deployment through lateral movement and credential abuse. Elastic Security SIEM, Elastic Defend (EDR), and Osquery power the blue team environment, with AI-assisted investigation and agentic response workflows at the center of the defender's toolkit.
Attendees will leave with practical experience operationalizing AI for alert triage and forensic analysis, executing machine-speed containment via agentic workflows, and closing detection gaps through threat intelligence integration and proactive hunting — reframing their mission from protecting a network perimeter to safeguarding identity at scale.