ATLSECCON 2025

In the complex world of OT/ICS environments, traditional approaches to threat hunting often fall short when handling vast datasets and detecting sophisticated threats. This talk introduces practical Jupyter Notebooks designed for large-scale threat hunting, with a focus on graph-based visualizations to uncover anomalies. Using APT Volt Typhoon’s tactics, techniques, and procedures (TTPs) as a case study, attendees will explore scalable methods for anomaly detection and detection engineering. The session emphasizes actionable strategies to build alerts for OT protocols like DNP3, BACnet, and Modbus, arming SOC teams to proactively safeguard critical infrastructure.