{"id":7585,"date":"2026-04-01T16:03:50","date_gmt":"2026-04-01T14:03:50","guid":{"rendered":"https:\/\/dcg420.org\/?page_id=7585"},"modified":"2026-04-11T23:43:02","modified_gmt":"2026-04-11T21:43:02","slug":"cti-hunt-det-workshop","status":"publish","type":"page","link":"https:\/\/www.dcg420.org\/en\/activities\/trainings\/cti-hunt-det-workshop\/","title":{"rendered":"CTI-Hunt-DET Workshop"},"content":{"rendered":"
\"https:\/\/www.dcg420.org\/wp-content\/uploads\/2026\/04\/DCG-Square-logos-13.png\"<\/div><\/div><\/div><\/div>
Training<\/div>

Proactive Defense Against Cyber Operations by China and Russia (CTI & External Hunt & Detection) – 28.5.2026<\/b><\/span><\/h3><\/div><\/header>

This workshop combines cyber threat intelligence (CTI) with practical external threat hunting (External Hunt) to enhance intelligence and apply it within detection engineering (Detection) to prevent potential attacks. Participants will first gain an overview of Russian and Chinese cyber operations through an analysis of selected APT groups, their motivations, tactics, and techniques and procedures (TTPs), and will learn the basics of attack attribution using frameworks such as MITRE ATT&CK and the Diamond Model. They will then <\/span>proceed<\/span> to practical exercises focused on actively searching for infrastructure (External Hunt) using tools for web scanning, fingerprinting, and pivoting techniques. They will use the intelligence gathered for detection engineering and create their own detection rules (Detection). The workshop thus provides a comprehensive overview of the activities of state-sponsored actors and equips participants with the analytical and practical skills needed to detect and track them.<\/span><\/span>\u00a0<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/section>

Detailed description<\/b><\/span><\/h3><\/div><\/header>

Part #1 – Cyber Operations by China and Russia: Analysis of APT Actors and the Basics of Attribution<\/span><\/b> (Trained by Cybule.cz)<\/span><\/h4>\n

The first part of the workshop focuses on cyber operations conducted by the Russian Federation and the People\u2019s Republic of China through an analysis of two selected APT groups. Participants will gain an overview of these groups\u2019 motivations, typical targets, and the tactics, techniques, and procedures (TTPs) they employ, based on specific case studies. Emphasis will be placed on understanding the broader geopolitical context of their activities. The workshop will also include an introduction to the attribution of cyberattacks using analytical frameworks such as MITRE ATT&CK, the Diamond Model, the Cyber Kill Chain, and the Alternative Hypothesis (ACH) method. In the practical part of the seminar, participants will practice detecting indicators of compromise (IOCs) and identifying the individual phases of an attack. <\/span><\/p>\n

Part #2 – External Threat Hunting – Unmasking Adversary Infrastructure<\/span><\/b> (Trained by DCG420.org)<\/span><\/h4>\n

In the second part of the workshop, you will delve into the proactive discipline of external threat hunting, which focuses on identifying and monitoring adversary infrastructure before it is used in an attack. Participants will learn to use tools for scanning the entire internet and specialized techniques to detect command-and-control (C2) servers, phishing sites, and other malicious assets associated with sophisticated threat actors, particularly those attributed to nation-state operations from China and Russia. We will examine key artifacts and pivoting techniques used to map attackers\u2019 networks and understand their operational methodologies.<\/span>\u00a0<\/span><\/p>\n

We will cover the basic use of free versions of tools such as Shodan, Censys, and FOFA, and introduce critical fingerprinting concepts such as JARM. A structured methodology for conducting external hunts will be presented, culminating in a guided use case simulating the tracking of infrastructure potentially linked to Chinese or Russian actors from the first part of the workshop. Participants will leave with actionable techniques and a proactive mindset for external threat hunting.\u00a0<\/span>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Part #3 – Forge Your Detection Against Advanced Threats <\/span><\/b>(Trained by DCG420.org)<\/span><\/h4>\n

In the final part of the workshop, we will focus on creating detection rules to counter potential attacks by APT groups. To do this, we will use the open-source tool Hefastos.org, it is an elite detection workbench that replaces static documentation with a Visual Graph Engine. It streamlines security engineering through a Git-native „Detection-as-Code“ workflow, automatically converting visual capability maps into valid SIGMA rules. Assisted by AI and fully integrated with MITRE ATT&CK\/D3FEND\/ENGAGE, it allows security teams to design, automate, and scale their defense logic visually.<\/span><\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/section>

Organizational information<\/b><\/span><\/h3><\/div><\/header>

Venue:<\/p>\n

Microsoft<\/p>\n

Vysko\u010dilova 1561\/4a, 140 00 Praha 4<\/a><\/p>\n<\/div>

<\/div>

Schedule<\/b><\/span><\/h3><\/div><\/header>

8:30 – Registration<\/span>\u00a0<\/span><\/p>\n

9:00 – Welcome<\/span>\u00a0<\/span><\/p>\n

9:10 – 12:00 – Part #1 – Cyber Operations by China and Russia: Analysis of APT Actors and the Basics of Attribution<\/span>\u00a0<\/span><\/p>\n

Coffee break – 10:30 – 10:45\u00a0<\/span>\u00a0<\/span><\/p>\n

12:00 – 13:00 – Lunch break<\/span>\u00a0<\/span><\/p>\n

13:00 \u2013 14:30 \u2013 Part #2 \u2013 External Threat Hunting – Unmasking Adversary Infrastructure<\/span>\u00a0<\/span><\/p>\n

Coffee break \u2013 14:30 \u2013 14:45\u00a0<\/span>\u00a0<\/span><\/p>\n

14:45 \u2013 16:00 \u2013 Part #3 \u2013 <\/span>Forge Your Detection Against Advanced Threats<\/span>\u00a0<\/span><\/p>\n

16:00 – Closing Remarks<\/span>\u00a0<\/span><\/p>\n

The workshop begins at 9:00 a.m. (We have <\/span>a jam-packed<\/span> schedule, so please be on time)<\/span><\/span>\u00a0<\/span><\/strong><\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/section>

Q&A<\/b><\/span><\/h3><\/div><\/header>
<\/div>