Antisyphon Training

Threat Hunting Summit Talk: Avoiding Hunt Amnesia: Building a Memory Your AI Can Use
2026-06-17 12:00 - 12:25 (America/New_York)
With Sydney Marrone

What if your next threat hunt could start with a simple question to your AI assistant: “What did we find last time we investigated lateral movement?”

Join Sydney Marrone, Head of Threat Hunting at Nebulock, as she introduces the LOCK pattern (Learn, Observe, Check, Keep), a lightweight framework for turning every investigation into a persistent, markdown‑based record your AI can actually use.

You’ll learn how to build a hunt repository that preserves institutional knowledge, accelerates future investigations, and gives both humans and AI assistants a shared memory to work from.

Give your hunting program a durable memory and watch your mean time to hypothesis drop.

Register Here

Chat with your fellow Threat Hunting Summit attendees in the Antisyphon Discord server: https://discord.gg/antisyphon

This talk is part of the Antisyphon Training Threat Hunting Summit, a free, six-hour, live virtual event designed to give you a practical, real-world look at how cyber threat hunters detect stealthy adversaries, investigate suspicious behavior, and turn discoveries into stronger defenses.

For those who want to go further, multiple hands-on, high-quality, and affordable training courses are available June 18-26 to help you sharpen your skills and become a more proactive, effective defender.

Learn more about the Threat Hunting Summit

See the entire Antisyphon Training Course Catalog for affordable cybersecurity training!

About the Instructor

Sydney Marrone

Bio

Sydney Marrone is a threat hunter, cybersecurity professional, co-founder of THOR Collective, author of the Agentic Threat Hunting Framework, and co-author of the PEAK Threat Hunting Framework. She is passionate about making security knowledge accessible and actionable through hands-on research, open-source collaboration, and community-driven projects like HEARTH (Hunting Exchange And Research Threat Hub). Sydney creates resources, leads workshops, and shares insights that spark curiosity and empower defenders. Outside of work, she writes for THOR Collective Dispatch, lifts weights, and makes cyber-themed music using AI to blend creativity and hacker culture.

Threat Hunting Summit Talk: Threat Hunting with RITA: A Behavioral Analysis of C2 Traffic
2026-06-17 13:00 - 13:25 (America/New_York)
With Hermon Kidane

How do you catch an attacker when their malware is specifically designed to blend in with everyday network noise?

Join Hermon Kidane, Network Threat Hunter at Active Countermeasures, as he walks you through a practical approach to finding covert command and control channels using RITA and Zeek telemetry.

You’ll learn how to analyze connection durations, beaconing cadences, and key metrics like network prevalence and first-seen behavior to spot DNS tunnels and persistent threats, cutting through the raw data to find the actual compromise.

Walk away with a downloadable custom dataset and some bonus hunting scripts, so you can immediately start practicing these techniques on your own.

Register Here

Chat with your fellow Threat Hunting Summit attendees in the Antisyphon Discord server: https://discord.gg/antisyphon

This talk is part of the Antisyphon Training Threat Hunting Summit, a free, six-hour, live virtual event designed to give you a practical, real-world look at how cyber threat hunters detect stealthy adversaries, investigate suspicious behavior, and turn discoveries into stronger defenses.

For those who want to go further, multiple hands-on, high-quality, and affordable training courses are available June 18-26 to help you sharpen your skills and become a more proactive, effective defender.

Learn more about the Threat Hunting Summit

See the entire Antisyphon Training Course Catalog for affordable cybersecurity training!

About the Instructor

Hermon Kidan

Bio

Hermon is a Network Threat Hunter at Active Countermeasures where he does behavioral analysis of network traffic to expose covert infrastructure. His daily work centers on translating raw Zeek telemetry into actionable threat intelligence to track down persistent, low-and-slow threats. Prior to hunting, he spent two years at a help desk and another two years as a systems administrator. In his spare time, he likes to tinker with his homelab, follow Formula 1, and watch movies.

Threat Hunting Summit Talk: Threat Hunting in the Dark: A Practical Approach
2026-06-17 13:30 - 13:55 (America/New_York)
With Shane Hartman

You know threats exist on your network—but where do you begin looking? Which direction should you go, and do you even have the data you need to find them?

Join Shane Hartman, Principal IR Consultant at TrustedSec, as he turns threat hunting from guesswork into a disciplined, hypothesis‑driven process.

You’ll learn how to cast a wide net, refine your hypotheses, validate suspicious behavior with real telemetry, and convert findings into actionable detections.

By the end of this session, you’ll have a repeatable method for creating, assessing, and executing hunts—so the next time you’re hunting in the dark, you won’t be going in blind.

Register Here

Chat with your fellow Threat Hunting Summit attendees in the Antisyphon Discord server: https://discord.gg/antisyphon

This talk is part of the Antisyphon Training Threat Hunting Summit, a free, six-hour, live virtual event designed to give you a practical, real-world look at how cyber threat hunters detect stealthy adversaries, investigate suspicious behavior, and turn discoveries into stronger defenses.

For those who want to go further, multiple hands-on, high-quality, and affordable training courses are available June 18-26 to help you sharpen your skills and become a more proactive, effective defender.

Learn more about the Threat Hunting Summit

See the entire Antisyphon Training Course Catalog for affordable cybersecurity training!

About the Instructor

Shane Hartman

Bio

Shane Hartman is a Principal Incident Response Consultant at TrustedSec, specializing in advanced threat hunting, forensic triage, and intrusion analysis. With over 30 years in IT and two decades in information security, Shane helps organizations detect, investigate, and contain targeted attacks against critical systems and intellectual property. His previous roles at FireEye, Fortinet, and RSA focused on malware reverse engineering, threat intelligence production, and adversary tradecraft analysis. He frequently presents and teaches at the University of South Florida on topics including Digital Forensics, Ethical Hacking, and Offensive Operations.

Threat Hunting Summit Panel: Legal Landmines, Insurance & Incident Response
2026-06-17 14:00 - 14:50 (America/New_York)
With Patterson Cake, Troy Wojewoda, John Danyluk and David Vanalek

When should you call your cyber insurance provider, and when should you bring in outside legal counsel? And does privilege actually protect your incident communications from discoverability during litigation?

Join Patterson Cake (Director of IR, BHIS), Troy Wojewoda (Incident Responder, Threat Hunter, and SOC Principal Analyst, BHIS), John Danyluk (Partner, Gentry Locke), and David Vanalek (Chief Legal and Compliance Officer, Richmond National Insurance) for a fast‑paced, candid panel discussion that demystifies the legal and insurance decisions every defender eventually faces.

You’ll learn how incident responders, insurers, and attorneys think about notification timelines, privilege, documentation, and the real‑world consequences of calling—or not calling—the right people at the right time.

Bring your toughest questions: the panel will open the floor for live Q&A so you can finally get straight answers to the insurance and legal questions no one ever explains.

Register Here

Chat with your fellow Threat Hunting Summit attendees in the Antisyphon Discord server: https://discord.gg/antisyphon

This talk is part of the Antisyphon Training Threat Hunting Summit, a free, six-hour, live virtual event designed to give you a practical, real-world look at how cyber threat hunters detect stealthy adversaries, investigate suspicious behavior, and turn discoveries into stronger defenses.

For those who want to go further, multiple hands-on, high-quality, and affordable training courses are available June 18-26 to help you sharpen your skills and become a more proactive, effective defender.

Troy Wojeowda will teach Threat Hunting on the Edge on June 18.

Patterson Cake will be teaching LOLBINS vs. LOLBINS: Endpoint Threat Hunting on June 19.

Learn more about the Threat Hunting Summit

See the entire Antisyphon Training Course Catalog for affordable cybersecurity training!

About the Instructors

Patterson Cake

Bio

Patterson Cake has worked in cybersecurity for more than two decades, specializing in the development of incident-response teams, programs, and processes. He is currently the Director of Incident Response for Black Hills Information Security, holds more than twenty-five industry certifications, is a former SANS instructor, teaches for Antisyphon, and has trained law enforcement, military, and national cybersecurity organizations on four continents. Patterson is the creator of the “Incident Response Capabilities Matrix Model,” developed “Rapid Triage Workflow” for IR investigations, is a prolific speaker, and is actively involved in the cybersecurity community.

Troy Wojewoda

Bio

Troy Wojewoda is a Security Analyst at Black Hills Information Security (BHIS). Prior to joining BHIS, Troy has held roles in application and system administration, host and network intrusion detection, wireless security, penetration testing, digital forensics, malware analysis, threat hunting, and incident response. In addition to earning several professional certifications, Troy has a BS in Computer Engineering and Computer Science.

David T. Vanalek

Bio

David T. Vanalek is the Chief Legal and Compliance Officer and Corporate Secretary of Richmond National, a specialty excess and surplus lines insurance company dedicated to writing hard to place risks for small and mid-sized businesses across the country headquartered in Richmond, Virginia. David is responsible for all corporate governance, regulatory, compliance, claims law, and litigation activities of the company and its affiliates, and serves as legal advisor to the leadership team, business units, and board of directors. Prior to joining Richmond National, David served as the Claims Chief Operating Officer at a global Fortune 500 insurance carrier, where he led the day to day operational support for all claims divisions responsible for all lines of business throughout North America and Bermuda. David also served for years in various claims leadership roles in the professional liability, cyber liability and management liability product lines. Prior to joining the insurance industry, Mr. Vanalek was in private practice as a commercial litigator, serving clients throughout California and Illinois. He received his Bachelor’s degree from the University of California, Los Angeles, and his law degree from the University of California, Davis, where he served as an Editor on Law Review, as well as a judicial extern for an associate justice of the California Supreme Court. Mr. Vanalek is a frequent speaker on insurance, claims, technology, professional liability, cyber liability and management liability issues.

John Danyluk

Bio

John Danyluk is a partner at Gentry Locke and a member of its Band‑1‑ranked White Collar Defense, Investigations & Compliance practice group. He represents corporate and individual clients through all phases of the criminal process and advises highly regulated industries—including government contractors, healthcare, and critical infrastructure—on compliance and risk. A Certified Information Privacy Professional (CIPP/US), he guides organizations through complex data‑privacy and cybersecurity obligations, conducts internal investigations, and helps clients navigate cyber incidents and regulatory scrutiny. John draws on his experience as an Army JAG Officer and former Special Assistant U.S. Attorney, where he litigated more than 1,000 cases and advised senior leaders on procurement, trade regulations, and national‑security matters.

Threat Hunting Summit Talk: Fast-track Reports into Ready-Made Hypotheses with AI
2026-06-17 15:00 - 15:25 (America/New_York)
With Lauren Proehl

What if every intelligence report instantly became a ready‑to‑run hypothesis — instead of dying in a Slack channel?

In this talk, Lauren Proehl, Global Head of Detection and Response at Marsh and co‑founder of THOR Collective, walks through a practical, repeatable workflow for using large language models to convert published threat reports into structured, testable hunt hypotheses.

She’ll break down how to extract attacker tradecraft, map TTPs, scope data sources, and generate analytic logic hunters can run immediately. Real examples will help you explore how crafted prompts can surface detection gaps, enrich investigations, and produce hypotheses that go far beyond IOC matching.

Examine how AI‑assisted workflows are reshaping the future of threat hunting and leave with a method you can put to work, whether you’re a solo hunter or running a mature program.

Register Here

Chat with your fellow Threat Hunting Summit attendees in the Antisyphon Discord server: https://discord.gg/antisyphon

This talk is part of the Antisyphon Training Threat Hunting Summit, a free, six-hour, live virtual event designed to give you a practical, real-world look at how cyber threat hunters detect stealthy adversaries, investigate suspicious behavior, and turn discoveries into stronger defenses.

For those who want to go further, multiple hands-on, high-quality, and affordable training courses are available June 18-26 to help you sharpen your skills and become a more proactive, effective defender.

Learn more about the Threat Hunting Summit

See the entire Antisyphon Training Course Catalog for affordable cybersecurity training!

About the Instructor

Lauren Proehl

Bio

Lauren Proehl leads detection and response globally at Marsh, overseeing the full lifecycle from threat intelligence through incident response and red teaming. She is co-founder of THOR Collective, a practitioner-driven cybersecurity collective, and has spent her career identifying and disrupting cyber adversaries across Fortune 500 networks — from data breaches to targeted intrusions. She now works to define some part of the limitless unknowns in cyberspace and make cybersecurity less abstract and more tangible. Lauren sits on the CFP board for BSides Kansas City, serves on the board of Urban Trail Co., and tries to escape computers by running long distances in the woods.

Threat Hunting Summit Keynote: Defending AI: Organized Musings on Securing AI Agents for Cybersecurity
2026-06-17 15:30 - 16:20 (America/New_York)
With Jason Haddix

Are you securing your AI agents, or just hoping the system prompt holds?

As AI agents move from prototypes into production, most security programs are still treating them like traditional apps or opaque black boxes – and that gap is where real risk is emerging.

Join Jason Haddix, CEO and “Hacker in Charge” at Arcanum Information Security, as he lays out a practical architecture for defending AI agents based on real-world assessments and organizing controls across the full ecosystem: application design and tool boundaries, system prompt hardening, and intermediate guardrails and classifier-based protections.

He’ll cover how attacks actually manifest across these layers, the best security practices and common missteps seen in development teams, and where open-source defensive tooling fits today.

The focus of this talk is pragmatic: giving defenders a usable mental model, concrete configurations, and the tradeoffs they need to understand to make AI systems survivable in production.

If you’re building or defending AI systems, this is the playbook you’ll want to have.

Register Here

Chat with your fellow Threat Hunting Summit attendees in the Antisyphon Discord server: https://discord.gg/antisyphon

This talk is part of the Antisyphon Training Threat Hunting Summit, a free, six-hour, live virtual event designed to give you a practical, real-world look at how cyber threat hunters detect stealthy adversaries, investigate suspicious behavior, and turn discoveries into stronger defenses.

For those who want to go further, multiple hands-on, high-quality, and affordable training courses are available June 18-26 to help you sharpen your skills and become a more proactive, effective defender.

Learn more about the Threat Hunting Summit

See the entire Antisyphon Training Course Catalog for affordable cybersecurity training!

About the Instructor

Jason Haddix

Bio

Jason Haddix, also known as jhaddix, is the CEO and “Hacker in Charge” at Arcanum Information Security. Arcanum is a world-class assessment and training company.

Jason has had a distinguished 20-year career in cybersecurity, previously serving as CISO of FLARE, CISO of Buddobot, CISO of Ubisoft, Head of Trust/Security/Operations at Bugcrowd, Director of Penetration Testing at HP, and Lead Penetration Tester at Redspin. He has also held positions doing mobile penetration testing, network/infrastructure security assessments, and static analysis. Jason is a hacker and bug hunter and is currently ranked 57th all-time on Bugcrowd’s bug bounty leaderboards. Currently, he specializes in recon, web application analysis, and emerging technologies. Jason has also authored many talks on offensive security methodology, including speaking at conferences such as DEFCON, Bsides, BlackHat, RSA, OWASP, Nullcon, SANS, IANS, BruCon, Toorcon and many more.

Threat Hunting on the Edge
2026-06-18 10:00 - 18:00 (America/New_York)

LOLBINS vs. LOLBINS: Endpoint Threat Hunting
2026-06-19 10:00 - 18:00 (America/New_York)

Cyber Threat Intelligence 101 2 Day Version
2026-06-22 10:00 - 2026-06-23 18:00 (America/Denver)

Intro to Network Threat Hunting
2026-06-24 10:00 - 2026-06-25 18:00 (America/New_York)

Agentic AI for Threat Hunting
2026-06-26 10:00 - 18:00 (America/New_York)

Active Defense and Cyber Deception with John Strand
2026-06-29 12:00 - 2026-07-02 16:00 (America/New_York)

Workshop: CI CD Exploitation and Hardening
2026-07-10 12:00 - 16:00 (America/New_York)

Professionally Evil CISSP Mentorship Program
2026-09-01 14:00 - 2026-09-06 16:00 (America/New_York)

Wild West Hackin' Fest Deadwood 2026
2026-10-06 08:00 - 2026-10-09 20:30 (America/Denver)

Active Directory Security and Hardening
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Attacking and Defending AI
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Advanced Endpoint Investigations
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Breaching the Cloud with Beau Bullock
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Cybersecurity Incident Command
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Defending M365 and Azure with Kevin Klingbile
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Enterprise DFIR Investigations: Ransomware & APT Attacks
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Foundations of Security Operations with Hayden Covington
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Fundamentals of Android Application Security Testing
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Fundamentals of Cybersecurity: Threats & Defenses
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Hacking and Defending Satellite Infrastructure
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Hands-On AI Security Risk Assessment
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Intro to IoT Hacking
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Network Forensics and Incident Response
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)

Next Level OSINT with Mishaal Khan
2026-10-06 08:30 - 2026-10-07 17:00 (America/Denver)
