homepage
Open menu
Talk with an expert

STAR Live Streaming Series

Hosted by Katie Nickels
OverviewFeatured LiveStreamArchivePresenter Biography

Overview

The SANS Threat Analysis Rundown (STAR) is a live streaming series that gives you essential insights into today's cyber threats. Hosted by SANS Certified Instructor Katie Nickels, STAR highlights different voices from the threat intelligence community, keeping you up to date with the latest developments and expert analysis in the world of cybersecurity.

Every day, analysts work tirelessly to monitor adversaries and protect our network defenses, but keeping up with everything can be overwhelming. STAR brings you insights directly from those on the front lines, breaking down critical information into actionable steps for your organization. Each month, we'll dive into different focus areas-sometimes zeroing in on specific adversaries or malware, other times offering a broader view of industry-targeted threats.

This SANS livestream series focuses on:

  • Providing actionable insights on current threats
  • Uniting diverse perspectives from the threat intelligence community
  • Highlighting expert opinions from those who track threats daily

Want to take your understanding of the ever-evolving threat landscape and what that means for your organization to the next level? Check out FOR578: Cyber Threat Intelligence and master effective communication at tactical, operational, and strategic levels.

Important Developments in Ransomware Trends and Exploitation of Major Vulnerabilities

Guest Speaker: Sean Gallagher

Read this episode's Blog for important links and resources




Watch Now!

Archived Sessions

Watch more episodes from this series, and other DFIR content, on our YouTube channel.
Kaseya VSA Attack
Katie is joined by John Hammond, Senior Security Researcher at Huntress Labs. Katie and John will chat about the recent Kaseya VSA attack that deployed REvil ransomware, including the latest updates on what happened and what defenders should think about for future potential attacks like this one.
View
SANS Threat Analysis Rundown - Ransomware with guest speaker Ryan Chapman
Katie and Ryan chat about open sources they use to track the many threats in the ransomware ecosystem, including malware families that commonly lead to ransomware.
View
Dissecting BadBlood: an Iranian APT Campaign
In this livestream, the speakers went over characteristics of a credential phishing campaign by TA453, challenges in attributing the activity, use of the Analysis of Competing Hypotheses technique to consider targeting, and best practices to use when analyzing threats, and much more!
View
Making Sense of SolarWinds Through the Lens of MITRE ATT&CK(R)
In this livestream, speakers went over a useful central repository for tracking reporting related to the SolarWinds compromise, a deep-dive into cloud techniques used by adversaries, new TTPs from the SolarWinds incident and related activity, strategies for hunting techniques and procedures of...
View
Quantifying Threat Actor Assessments
In this livestream, speakers went over how existing risk assessment methodologies don't adequately assess human threats, factors to consider when assessing threats, including intent, capability, willingness, and novelty, examples of how the Threat Box methodology can be used to quantitatively...
View
Spooky RYUKy: The Return of UNC1878
In this livestream, speakers went over how they've clustered and tracked various uncategorized groups behind RYUK ransomware, the average "Time to RYUK" from when the operators gain access to when they encrypt data, how the Mandiant team categorizes activity using UNC (standing for UNCategorized...
View
The Value of Commercial Threat Intelligence Sources
Two researchers presented their peer-reviewed paper on commercial threat intelligence sources, published recently at USENIX Security 20. They described what the services of two leading vendors consist of, and find that there exists hardly any overlap between their indicator sets - even for specific...
View
Becoming the Adversary: Creating a Defensive Lab to Understand the Offense
In this livestream, speakers went over how you can start setting up your defensive lab, no matter what your experience level is, and ways you can mimic adversaries and then analyze your system to find your activity.
View
The Only Constant is Change: Tracking Adversary Trends
In this livestream, speakers went over how events like holidays, global pandemics, or other events might change adversaries daily activities, key trends and methodology observed in adversaries based on tracking characteristics like malware and infrastructure, how these tracking methods can be...
View
Threat Hunting and the Rise of Targeted eCrime Intrusions
In this livestream, speakers went over how eCrime intrusion trends have compared to state-sponsored intrusions, what hunting leads the CrowdStrike Overwatch team has used to identify activity, how looking for unusual process trees can assist in identifying adversaries, what notable TTPs the...
View
How Threats are Responding to COVID-19
In this livestream, speakers went over how threats have shifted in some ways based on the COVID-19 pandemic but remained similar in other ways, what cybercriminals are doing on the dark web, including selling medical supplies and discussing a possible "code of ethics" for not going after certain...
View
xHunt - An Anime Fan's Attack Campaign in the Middle East
In this livestream speakers went over what's been happening with threat activity over the past month, including a shift to COVID-19 themes, how analysts from Unit 42 used unique infrastructure and artifact overlaps to identify a campaign they named xHunt - and why they called it a campaign rather...
View
Cyber Threats To Electric Industry
In this livestream, speakers went over a rundown of recent threats analysts are talking about, how headlines like "the grid is under attack" can be misleading, a breakdown on how "the grid" is a complex set of assets, how to create activity groups by clustering with the Diamond Model to help teams...
View
    star_webcasts_nickels_470_x382.png

    Presenter Bio

    Katie Nickels

    Katie is a SANS instructor for FOR578: Cyber Threat Intelligence and a Principal Intelligence Analyst for Red Canary. She has worked on cyber threat intelligence (CTI), network defense, and incident response for nearly a decade for the DoD, MITRE, Raytheon, and ManTech. Katie hails from a liberal arts background with degrees from Smith College and Georgetown University, embracing the power of applying liberal arts prowess to cybersecurity. With more than a dozen publications to her name, Katie has shared her expertise with presentations at BSidesLV, the FIRST CTI Symposium, multiple SANS Summits, Sp4rkcon, and many other events. Katie is also a member of the SANS CTI Summit and Threat Hunting Summit Advisory Boards. She was the 2018 recipient of the President's Award from the Women's Society of Cyberjutsu and serves as the Program Manager for the Cyberjutsu Girls Academy, which seeks to inspire young women to learn more about STEM. You can find Katie on Twitter @LiketheCoins