Hunting Malicious Infrastructure

This 4-hour workshop introduces practical techniques for hunting Command-and-Control (C2) infrastructure using search engines for internet connected devices. Participants will start with the basics of search engines, then learn how to pivot from IOCs like domains, IPs, and certificates to uncover related hosts. The session also covers reading GitHub source code to extract network indicators and create queries that identify live C2 servers. Through guided labs, you’ll practice turning IOCs into searches, analyzing results, and documenting hunts. By the end, you’ll be able to build repeatable workflows for discovering C2 infrastructure safely and effectively.