NTTDATA-CERT Member Presents Briefing Session at SecTor 2024 (hosted by Black Hat)

Session Overview

DFIR (Digital Forensics and Incident Response) practitioners need to examine a wide variety of artifacts such as event logs, registries, file systems, and memory at the time of an incident. Furthermore, in environments where EDR and SIEM solutions have not been implemented or are not fully operational, it is extremely difficult to quickly and comprehensively investigate these artifacts.

In this session, as a solution to the above issues, we will explain the DFIR methodology that utilizes the open source tools Hayabusa ^*1 and Takajo^*2 developed by the YamatoSecurity Group^*3 in Japan and the knowledge of the Sigma community ^*4 . Utilizing these open source tools, and through simple command line operations, we will show how community knowledge can be quickly and efficiently incorporated to significantly improve the accuracy and efficiency of a survey.

• *1 https://github.com/Yamato-Security/hayabusa
• *2 https://github.com/Yamato-Security/takajo
• *3 https://github.com/Yamato-Security
• *4 https://sigmahq.io/

SecTor

SecTor is Canada's leading Black Hat-sponsored international conference gathering experts and researchers at the forefront of the cybersecurity field. Since its inaugural event in 2007, SecTor has attracted a large number of attendees each year, providing the latest information on information security research, developments, vulnerabilities, attack methods, and trends.

Last year's SecTor 2023 had more than 4,100 attendees, making it a large international conference where cutting-edge security topics were shared. This year, we expect that many industry leaders and experts will gather to discuss and share cutting-edge security topics.

NTTDATA-CERT

NTTDATA-CERT, to which the speaker belongs, is the CSIRT organization (Computer Security Incident Response Team) of the NTT DATA Group. NTTDATA-CERT works with domestic and international organizations on security measures to prevent and respond to incidents.

In addition, NTTDATA-CERT is promoting efforts to contribute to the improvement of society's security, and as an example, together with the volunteer members of the YamatoSecurity group, we are developing and promoting open source tools such as Hayabusa/Takajo/Sigma, which will be explained in this presentation.