BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: GhostCatcher (endpoint detection agent)\n   Tags: DE
 F CON Demo Labs | Intermediate | Defense/Blue Team | Purple\n   Team | DEF
  CON Demo Labs\n   When: Friday\, Aug 7\, 15:00 - 15:45 PDT\n   Where: LVC
 CW Level 1 Hall 3 1001 (Demo Labs Track 1) - [1]Map\n\n   Description:\n\n
    GhostCatcher is an open-source Linux endpoint detection agent written\n
    in Go. It runs as a single binary or a systemd service and looks for\n 
   host-visible adversary tradecraft on Linux: web shells\, LD_PRELOAD\n   
 abuse\, SSH\, cron\, and systemd persistence\, PAM/sudoers tampering\, SUI
 D\n   and capability drift\, reverse shells and unexpected network behavio
 r\,\n   reflective / memory-map signals\, and related patterns aligned wit
 h\n   MITRE ATT&CK-style coverage. Detections are driven by a versioned\,\
 n   optionally signed rule pack\, baselines and learning mode\, multi-sign
 al\n   scoring\, time-windowed correlation\, CEL-style boolean expressions
 \,\n   optional Sigma-lite rules\, optional YARA (disk and memory) and eBP
 F\n   (with auditd/proc fallbacks)\, and JSONL output to stdout plus optio
 nal\n   syslog\, Splunk HEC\, Elasticsearch _bulk\, or Grafana Loki. The g
 oal is\n   to give blue teams a transparent\, self-hosted way to turn Linu
 x host\n   telemetry into actionable events in the SIEM—without a vendor
  cloud\n   control plane.\n\n   SpeakerBio:  Sercan Okur\n\n   Sercan Okur
  is the Founder and CEO of NextRay AI Detection & Response\,\n   Inc.\, a 
 San Jose–based cybersecurity company building AI-driven\n   Network Dete
 ction and Response technology. A cybersecurity\n   practitioner with more 
 than fifteen years of experience across\n   critical-infrastructure\, defe
 nse\, and enterprise environments\,\n\n   Links:\n       GitHub - [2]https
 ://github.com/sercanokur/GhostCatcherEDR\n   '\n\n   1. #LVCCW_Level1_Hall
 3\n   2. https://github.com/sercanokur/GhostCatcherEDR\n\n\n
DTEND:20260807T224500Z
DTSTART:20260807T220000Z
LOCATION:Demo Labs - LVCCW Level 1 Hall 3 1001 (Demo Labs Track 1)
SUMMARY:GhostCatcher (endpoint detection agent)
END:VEVENT
END:VCALENDAR