This hands-on workshop walked through how security teams can simulate real-world attacks and investigate them using a SIEM. Participants deployed a multi-stage threat using SCYTHE, then pivoted into Splunk to hunt for indicators of compromise across endpoint telemetry. The session focused on practical techniques for identifying malicious behavior, mapping activity to the MITRE ATT&CK framework and strengthening threat detection workflows.
Attendees joined to:
- Learn how to deploy and simulate multi-stage threats using SCYTHE
- Understand how endpoint telemetry from Sysmon and Windows logs reveals attacker activity
- See how detected behavior can be mapped to MITRE ATT&CK techniques for clearer analysis
- Discover how custom dashboards and queries in Splunk support more effective threat hunting
We hope attendees walked away with practical experience detecting and investigating sophisticated cyber threats in a SIEM environment.