Incident Response

W01 Tales from Incident Response: Unmasking the Threat Actor’s Inner Sanctum

05/14/2025

9:00am - 10:00am

Level: Advanced

Hasain Alshakarti

Principal Cybersecurity Advisor

Truesec

Imagine if You Could Watch Every Step They Take…

Unmasking a threat actors activities is sometime like deciphering an ancient manuscript, but what if you can see every move and control when to strike the pause.

This session is not about log analysis, or following the breadcrumbs left by an elusive adversary. It is about having a full timeline of the threat actors machine and knowing exactly what was done without assumptions or guessing!

You will learn:

  • The importance of monitoring
  • How does access brokers operate
  • The importance of quick response