A Practical Malware Analysis & Threat Hunting with Memory Forensics, Endpoint Telemetry, & AI-Driven Hunting

Name of Training: A Practical Malware Analysis & Threat Hunting with Memory Forensics, Endpoint Telemetry, & AI-Driven Hunting
Trainer: Monnappa, Sajan Shetty
Dates: November 08-10, 2026
Time: 9:00 am - 5:00 pm
Venue: Exhibition World Bahrain
Cost: 1200 BHD

1. Short Summary

This hands-on training covers malware analysis, reverse engineering, memory forensics, and endpoint telemetry-based threat hunting. It also introduces AI-powered hunting with the Garuda Framework to triage events, extract IOCs, and detect unknown attacks without relying on signatures or patterns.

2. Course Description

This intensive, hands-on training teaches the concepts, tools, and techniques required to analyze, investigate, and hunt malware by combining four powerful approaches: malware analysis, reverse engineering, memory forensics, and endpoint telemetry-based threat hunting.

The course begins with the foundations of malware analysis, Windows internals, and memory forensics, before moving into advanced concepts of malware investigation and hunting adversary techniques.

3. Course Outline

Day 1

3.1 Introduction to Malware Analysis

3.1.1 What is Malware
3.1.2 What they do
3.1.3 Why malware analysis
3.1.4 Types of malware analysis
3.1.5 Setting up an isolated lab environment

3.2 Static Analysis

3.2.1 Fingerprinting the malware
3.2.2 Extracting strings
3.2.3 Determining File obfuscation
3.2.4 Pattern matching using YARA
3.2.5 Fuzzing hashing & comparison
3.2.6 Understanding PE File characteristics
3.2.7 Hands-on lab exercise involves analyzing real malware sample

3.3 Dynamic Analysis / Behavioural Analysis

3.3.1 Dynamic Analysis Steps
3.3.2 Understanding Dynamic Analysis tools
3.3.3 Simulating services
3.3.4 Performing Dynamic Analysis
3.3.5 Monitoring process, filesystem, registry, and network activity
3.3.6 Determining the Indicators of compromise (host and network indicators)
3.3.7 Demo - Showing the static & dynamic analysis of real malware sample
3.3.8 Hands-on lab exercise involves analyzing real malware sample

3.4 Automating Malware Analysis (Sandbox)

3.4.1 Custom Sandbox Overview
3.4.2 Working of Sandbox
3.4.3 Sandbox Features
3.4.4 Demo - Analyzing malware in the custom sandbox

3.5 Malware Persistence Methods

3.5.1 Run registry key
3.5.2 Scheduled Tasks
3.5.3 Startup Folder
3.5.4 Service
3.5.5 Winlogon registry entries
3.5.6 Image File Execution Options (IFEO)
3.5.7 Accessibility programs
3.5.8 AppInit_DLLs
3.5.9 DLL Search order hijacking
3.5.10 Hands-on lab exercise involves analyzing real malware sample

Day 2

3.6 Code Analysis

3.6.1 Code Analysis Overview
3.6.2 Disassembler & Debuggers
3.6.3 Code Analysis Tools
3.6.4 Basics of IDA Pro
3.6.5 Basics of x64dbg
3.6.6 Understanding API Calls
3.6.7 Cross References using IDA
3.6.8 Cross References using x64dbg

3.7 Reversing Malware Functionalities

3.7.1 Downloader
3.7.2 Dropper
3.7.3 Keylogger
3.7.4 Code injection (Fileless malware)
3.7.5 Malware replication via removable media
3.7.6 Malware Command & Control (C2)

3.8 Introduction to Memory Forensics

3.8.1 What is Memory Forensics
3.8.2 Why Memory Forensics
3.8.3 Steps in Memory Forensics
3.8.4 Memory acquisition and tools
3.8.5 Acquiring memory From physical machine
3.8.6 Acquiring memory from virtual machine
3.8.7 The hands-on exercise involves acquiring the memory

3.9 Volatility Overview

3.9.1 Introduction to Volatility Advanced Memory Forensics Framework
3.9.2 Volatility Installation
3.9.3 Volatility basic commands
3.9.4 Determining the profile
3.9.5 Volatility help options
3.9.6 Running the plugin

3.10 Investigating Process

3.10.1 Understanding Process Internals
3.10.2 Process (EPROCESS) Structure
3.10.3 Process organization
3.10.4 Process Enumeration by walking the double linked list
3.10.5 Process relationship (parent-child relationship)
3.10.6 Understanding DKOM attacks
3.10.7 Process Enumeration using pool tag scanning
3.10.8 Volatility plugins to enumerate processes
3.10.9 Identifying malware process
3.10.10 Hands-on lab exercise (scenario-based) involves investigating malware infected memory

3.11 Investigating Process Handles & Registry

3.11.1 Objects and handles overview
3.11.2 Enumerating process handles using Volatility
3.11.3 Understanding Mutex
3.11.4 Detecting malware presence using the mutex
3.11.5 Understanding the Registry
3.11.6 Investigating common registry keys using Volatility
3.11.7 Detecting malware persistence
3.11.8 Hands-on lab exercise (scenario-based) involves investigating malware infected memory

3.12 Investigating Network Activities

3.12.1 Understanding malware network activities
3.12.2 Volatility Network Plugins
3.12.3 Investigating Network connections
3.12.4 Investigating Sockets
3.12.5 Hands-on lab exercise (scenario-based) involves investigating malware infected memory

3.13 Investigation Process Memory

3.13.1 Process memory Internals
3.13.2 Listing DLLs using Volatility
3.13.3 Identifying hidden DLLs
3.13.4 Dumping malicious executable from memory
3.13.5 Dumping Dll's from memory
3.13.6 Scanning the memory for patterns (yarascan)
3.13.7 Hands-on lab exercise (scenario-based) involves investigating malware infected memory

Day 3

3.14 Investigating User-Mode Rootkits & Fileless Malwares

3.14.1 Code Injection
3.14.2 Types of Code injection
3.14.3 Remote DLL injection
3.14.4 Remote Code injection
3.14.5 Reflective DLL injection
3.14.6 Hollow process injection
3.14.7 Demo - Case Study
3.14.8 Hands-on lab exercise (scenario based) involves investigating malware infected memory

3.15 Investigating Kernel-Mode Rootkits

3.15.1 Understanding Rootkits
3.15.2 Understanding Functional call traversal in Windows
3.15.3 Level of Hooking/Modification on Windows
3.15.4 Kernel Volatility plugins
3.15.5 Hands-on lab exercise (scenario-based) involves investigating malware infected memory
3.15.6 Demo - Rootkit Investigation

3.16 Threat Hunting Using Endpoint Telemetry

3.16.1 Introduction to Sysmon
3.16.2 Understanding Sysmon Events
3.16.3 Introduction to Garuda Threat Hunting Framework
3.16.4 Filtering Sysmon events using Garuda
3.16.5 Living off the Land attacks
3.16.6 Demo: Hunting LoLbins (Living of the land binary) and multi-staged attacks

3.17 AI-Powered Threat Hunting

3.17.1 Introduction to AI in threat detection & hunting
3.17.2 Introduction to MCP (Model Context Protocol)
3.17.3 Exposing Tools to the LLM
3.17.4 Integrating Garuda Framework with AI application
3.17.5 How Garuda + AI can triage events, identify IOCs, and Map events to ATT&CK Techniques
3.17.6 Demo: AI-powered autonomous Threat hunting to hunt for complex attack patterns

4. Difficulty Level

Beginner - The student has an interest in the topic presented and general technology knowledge that a power user or undergraduate student may have acquired.

Intermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.

Advanced - The student is expected to have significant practical experience with the tools and technologies that the training will focus on.

Expert or Specialized - The student has a solid understanding of the topic at hand, usually with knowledge of relevant standards, tactics, tools, and years of relevant hands-on experience. Students should expect to use these skills with agility to solve problems in novel ways.

5. Suggested Prerequisites

• Students should be familiar with using Windows/Linux.
• Students should have an understanding of basic programming concepts, while programming experience is not mandatory.

6. What Students Should Bring

• Laptop with a minimum of 8GB RAM and 60GB free hard disk space
• Laptop with USB ports - lab samples and custom Linux VM will be shared via USB sticks
• VMware Workstation or VMware Fusion (even trial versions can be used)
• Windows Operating system (preferably 64-bit versions of Windows 11 or Windows 10) installed inside the VMware Workstation/Fusion. Students must have full administrator access to the Windows operating system installed inside the VMware Workstation/Fusion.

Note: VMware Player or VirtualBox is not suitable for this training. Apple systems using the M1 processor line cannot perform the necessary virtualization functionality; therefore, they are not suitable for this course.

7. What the Trainer Will Provide

7.1 Course material (pdf copy)
7.2 Lab solution material
7.3 Videos used in the course
7.4 Malware samples used in the course/labs
7.5 Memory Images used in the course/labs
7.6 Linux VM (to be opened with VMware Workstation/Fusion) containing necessary tools and samples
7.7 Custom tools

8. Trainer(s) Bio

Monnappa K A

Monnappa K A is a Security Professional with over 17 years of experience in incident response, investigation, and threat hunting. He previously worked for Microsoft and Cisco as a threat hunter, mainly focusing on the investigation and research of advanced cyberattacks. He is the author of the best-selling book Learning Malware Analysis, and serves on the review board for Black Hat Asia, Black Hat USA, and Black Hat Europe.

He is the creator of the Garuda Threat Hunting Framework, Limon Linux sandbox, and the winner of the Volatility Plugin Contest 2016. He co-founded the cybersecurity research community Cysinfo (https://www.cysinfo.com).

Monnappa has trained thousands of security professionals globally through his highly acclaimed hands-on training sessions on malware analysis, reverse engineering, memory forensics, and threat hunting at major conferences such as Black Hat (USA, Europe, Asia, MEA), DEFCON, BruCON, HITB, FIRST (Forum of Incident Response and Security Teams), SEC-T, OPCDE, and 4SICS-SCADA/ICS cybersecurity summit.

He has also presented at numerous security conferences, including Black Hat, DEFCON, FIRST, DSCI, National Cyber Defence Summit, Bharat NCX, and Cysinfo meetings, covering topics related to threat hunting, memory forensics, malware analysis, and reverse engineering.

In addition, he has authored articles for eForensics and Hakin9 magazines. You can find some of his contributions to the community on his YouTube channel (http://www.youtube.com/c/MonnappaKA), and you can read his blog posts at https://cysinfo.com.

Twitter: @monnappa22

Sajan Shetty

Sajan Shetty is a Cyber Security enthusiast. He is an active member of Cysinfo, an open Cyber Security Community (https://www.cysinfo.com) committed to educating, empowering, inspiring, and equipping cyber security professionals and students to better fight and defend against cyber threats.

He has conducted training sessions at Black Hat, DEFCON, BRUCON and HITB, and his primary fields of interest include machine learning, malware analysis, and memory forensics. He has various certifications in machine learning and is passionate about applying machine learning techniques to solve cybersecurity problems.

9. Registration Terms and Conditions

9.1 Trainings are refundable before September 21, 2026, minus a non-refundable processing fee of 100 BHD.

9.2 Between September 21, 2026 and October 21, 2026 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of 100 BHD.

9.3 All trainings are non-refundable after October 21, 2026.

9.4 Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.

9.5 If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).

9.6 Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.

9.7 DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.

9.8 By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.