Explore sessions and plan your time at RSAC™ 2026 Conference using the Full Agenda. Visit Create Your Schedule for details on favoriting vs. reserving a seat (when available), and how to secure your spot before the line closes 5 minutes prior to any session onsite.
 
See some amazing sessions you’d like to attend but need to upgrade your pass? Learn how.
Back to Session CatalogBack to Session Catalog
Master Threat Hunting: Hands-On with Elastic and Forensics Tools - [LAB2-T01]
  • Tuesday, Mar 248:30 AM - 10:30 AM PDT
    Moscone West 3005
    Reserved Seating
Analyze a real two-month Latrodectus intrusion using Elastic Stack, CyberChef, Volatility, and Wireshark. Participants will hunt through network traffic, memory dumps, and SIEM data to uncover the complete attack chain from JavaScript loader to data exfiltration. Gain hands-on experience with industry-standard tools while building practical threat hunting skills.
Session Prerequisites:

Basic familiarity with network protocols, Windows operating systems, and command line interfaces. No advanced experience required with Elastic, Volatility, or Wireshark.

The lab environment requires an email address be used to access a one time use code. Participants who do not want to use their personal email are encouraged to set up a dummy account with a service provider like temp-mail.org. Those who utilize their personal email address, data is not shared, will be permanently deleted within seven days of the conference by the lab service provider.

Requested Materials & Setup :
  • Laptop enabled with a web browser required
  • Install Wireshark (https://www.wireshark.org)
  • Email address capable of accessing one time use code
Additional Information: This session will follow Chatham House Rule to allow for free exchange of information and learning. We look forward to participants actively engaging in the discussion and remind attendees that no comment attribution or recording of any sort should take place. Media Pass holders, College Day Pass holders, and Security Scholars are not permitted to attend. This is a capacity-controlled session. You may reserve a seat in only one Learning Lab. If added to your schedule and your availability changes, please remove this session from your schedule to allow others to participate.

Session Participant(s)

Type/Format: Learning Lab
Topic/Track: Network & Communications Security
Pass Requirement: All AccessCISO Boot CampCyber Leaders ForumESAFSpeaker
Session Classification: Intermediate—Technical
Recording Status: Not Recorded