Computer Security Researcher
13
Talks Delivered
13
Events Spoken At
11
Countries Visited
3
Years Speaking
13
Total Talks Given
Diyar Saadi Ali is a cybersecurity expert specializing in cybercrime investigations, SOC operations, and malware analysis. A certified MITRE ATT&CK Contributor and CVE discoverer, including CVE-2024-25400, CVE-2024-25399, and CVE-2026-20841, Diyar helps organizations defend against evolving digital threats. Diyar has spoken at major international conferences including Black Hat MEA in Saudi Arabia, DeepSec in Vienna, COSAC in Ireland, VulnCon in India, BSides Budapest, BSides Ireland , THCon Party, and the Arab Cyber Security Conference in Egypt. With extensive hands-on experience and a strong focus on analyst enablement, Diyar delivers practical and real-world malware analysis training.
This presentation explores the inner workings of Master Boot Record (MBR) bootkits through in-depth static and dynamic analysis. We will dissect the infection chain, examine disk manipulation techniques, and reverse engineer the bootloader modifications used to gain persistence before the operating system loads. Attendees will learn how MBR bootkits communicate with hardware, evade detection, and implement self-protection mechanisms. The session concludes with memory forensics insights and a practical analysis of an MBR ransomware locker in action.
Presentation Types
Audience Types
Advanced Rootkit Detection via Memory Forensics focuses on identifying stealthy rootkits that hide their presence to maintain unauthorized access to compromised systems. The session explains what rootkits are, why attackers rely on them, and how they operate to conceal malicious activity, steal sensitive data, or deploy additional malware. Emphasis is placed on the importance of detection, as rootkits often evade traditional security controls and require specialized forensic techniques to uncover.
The presentation covers the full rootkit lifecycle, differentiates between user mode and kernel mode rootkits, and explains where rootkits reside within an infected system. Attendees learn how rootkits manipulate kernel structures, including unlinking processes from EPROCESS, to remain invisible to standard system utilities. Memory forensics is presented as the most effective approach for detecting these hidden artifacts.
Through hands on demonstrations, the session walks through advanced rootkit hunting techniques using memory analysis tools such as Volatility3 and MemProcFS. Topics include identifying suspicious kernel drivers, enumerating driver entries in the registry, extracting malicious drivers directly from memory, analyzing device object paths, inspecting loader module entries, and reviewing event logs from memory images. Additional investigations focus on orphan or hidden processes, suspicious command line artifacts, and anomalous driver modules.
The analysis is extended with threat intelligence correlation and reverse engineering. Extracted drivers and DLLs are analyzed using tools such as PeStudio, sandbox environments, and manual reverse engineering to inspect exports, behavior, and malicious functionality. The session concludes by mapping rootkit indicators against public intelligence reports, equipping analysts with practical skills to detect, analyze, and respond to advanced rootkit infections using memory forensics.
Click. Plug. Compromise. A Case Study of a Malware Infested Camera presents a real world investigation into a malware infection originating from a compromised camera device. The session walks through how the incident began, the role of removable media and embedded files, and how simple user interaction can lead to full system compromise through social engineering and deceptive file structures.
The analysis begins with basic static analysis, examining the file structure and execution chain. This includes VBScript triggering batch files, batch scripts performing dropper operations, and the final payload hidden inside a DAT file that contains an executable with a valid MZ header. The presentation highlights social engineering techniques such as legitimate looking files and folders, as well as initial PE analysis and string analysis of both original and dropped payloads.
Dynamic analysis follows, demonstrating how the malware executes batch scripts, creates fake system directories, deletes itself to evade detection, and runs Base64 encoded PowerShell commands. Persistence mechanisms are identified through registry modifications, service creation, and scheduled tasks. The session also covers process injection, remote connections, communication with a cryptocurrency miner, and the download of additional malicious files.
The investigation is expanded with basic network analysis, including simulated traffic, DNS queries related to mining activity, HTTP requests used to download payloads, and extraction of network objects. Finally, threat intelligence and OSINT techniques are applied to correlate domains, identify miner infrastructure and workers, analyze passive DNS data, and map related files and domains. The session concludes with communication diagrams, infection chain visualization, and MITRE ATTACK mapping, providing a complete end to end case study of a malware infected device.
Digital forensics plays a critical role in malware analysis by revealing execution traces, persistence mechanisms, and attacker behavior that may not be visible through static or dynamic malware analysis alone. This talk focuses on forensic artifacts from a malware analyst’s standpoint, emphasizing how Windows artifacts can be used to reconstruct attacker activity, validate malware execution, and correlate events across the system. The session begins with a brief overview of digital and computer forensics, followed by an explanation of the forensic investigation lifecycle as it applies specifically to malware analysis. Core forensic artifacts such as registry keys, event logs, file system metadata, and execution traces are introduced with an emphasis on their evidentiary value during incident response and post-compromise investigations. Attendees will gain deep insight into execution artifacts including Prefetch, UserAssist, BAM, AmCache, PCA, PowerShell history, Windows Defender logs, Scheduled Tasks, Startup entries, and USB device history. The talk also covers registry-based persistence mechanisms, Windows Event Logs including EID 4688, EID 4104, and Microsoft Office alert events, as well as Sysmon telemetry with practical guidance on installation, configuration, and monitoring. The session concludes with a demonstration of modern forensic tools such as Artifast Suite, OSForensics, Registry Explorer, and FTK Imager, highlighting real-world case analysis from prefetch data, pagefile artifacts, and USN Journal entries. Attendees will leave with actionable knowledge to efficiently collect, analyze, and interpret forensic artifacts in support of malware investigations.
The presentation "Keys to Freedom: Analysis and Resolution of Arab Ransom Locker Infections" explores the intricate workings of the Arab Ransom Locker malware, focusing on its impact on mobile devices. This session delves into a comprehensive analysis of the ransomware's attack vector, encryption mechanisms, and behavioral patterns. It will also provide a step-by-step guide to unlocking infected devices, including proven recovery techniques, decryption tools, and preventive strategies.Targeted at cybersecurity professionals and mobile device users, the presentation aims to equip attendees with actionable insights to understand, mitigate, and neutralize the threat posed by this malicious ransomware.
Locker ransomware is a form of malware that blocks user access to their device by locking the screen, demanding a ransom to restore control. Unlike crypto-ransomware, it doesn’t encrypt files. However, because it shares behavioral traits . such as demanding payment and preventing normal system usage . it's often classified as ransomware. This session dives deep into the reverse engineering process of locker ransomware, focusing on how it operates, hides, and locks access. We begin with basic static analysis: examining the PE header, identifying the compiler used, scanning for suspicious strings, and evaluating the import address table. Tools like PE Studio, DIE, BinText, and 4n4lDetector are introduced for initial analysis. For .NET-based locker samples, we explore dnSpy, ILSpy, and dotPeek to view and analyze decompiled code. We also cover native binaries using tools like IDA Pro, Ghidra, and Radare2. You'll learn how to identify packers by section names and unpack them using utilities like UPX and de4dot. The session also explains the unlocking chain: how the ransomware checks for a key (hardcoded or file-based), the process of validation, and unlocking. We'll inspect features like VM/sandbox detection, persistence through registry or Task Scheduler, and USB spread mechanisms. Techniques to disable Task Manager, Registry Editor, and recovery options are also reviewed.Finally, we emphasize string analysis to locate embedded keys, understand behavior, and trigger unlock conditions. Real-world code snippets and logic breakdowns are shared to demonstrate how to defeat and reverse engineer locker ransomware effectively.
Firmware, essential to hardware functionality, increasingly becomes a prime target for cyber threat actors because of its foundational control over devices. This presentation delves into a detailed analysis of malware embedded within purported firmware updates for Sabrent devices, a case study revealing widespread exploitation. By leveraging advanced static and dynamic analysis techniques, we uncover the intricate workings of this malware, strategically hidden within seemingly legitimate firmware patches. Through meticulous investigation, including static examination for file headers, hashes, and embedded resources, and dynamic analysis within controlled environments, we decipher the malware’s operational stages. This includes its initial execution triggers, subsequent macro-driven deployments, and ultimate persistence mechanisms through.
Command and Control (C2) infrastructure is a critical component in the execution of cyberattacks, allowing attackers to remotely control compromised systems, deploy malware, and exfiltrate sensitive data. This document explores the intricate processes and techniques used for C2 hunting, focusing on methods to track, identify, and disrupt C2 servers used by cybercriminals. The guide covers various aspects of C2 hunting, beginning with an introduction to C2 communication methods and frameworks, such as DNS, HTTP, and IRC, commonly used by adversaries. The importance of hunting C2 is emphasized, highlighting its role in disrupting cyberattacks, preventing data exfiltration, and halting the spread of malware. In-depth attention is given to Open-Source Intelligence (OSINT) tools and public platforms, such as Shodan, VirusTotal, and ThreatFox, which provide valuable data on suspicious IP addresses, domains, and C2 infrastructure. It further discusses Google Dorking, a technique that leverages advanced search queries to discover exposed C2 servers and control panels. The document also details live C2 infrastructure hunting, showcasing how real-time analysis of network traffic and threat intelligence platforms can help security professionals track and block malicious C2 servers. The process of analyzing malware and its indicators, including IP addresses, domain names, and communication behaviors, is explored, providing a deeper understanding of how C2 servers operate. In conclusion, the guide stresses the importance of continuous learning in the field of C2 hunting, recommending various platforms and resources for further study. The growing role of threat intelligence platforms in proactive cybersecurity is highlighted as an essential tool for identifying and mitigating C2-related threats. This document serves as a comprehensive resource for cybersecurity professionals, malware analysts, and anyone interested in enhancing their skills in identifying and mitigating malicious C2 infrastructure.
Artificial Intelligence (AI) is transforming red teaming by automating and optimizing offensive cybersecurity strategies. AI-powered red teams can rapidly conduct reconnaissance, identify vulnerabilities, and execute complex exploits with unprecedented efficiency. Machine learning enables adaptive attacks that evolve in real time, emulating the behavior of advanced persistent threats (APTs). Furthermore, AI enhances social engineering techniques, generating sophisticated phishing campaigns and leveraging deepfake technology for deception. While AI-driven red teaming improves the realism and effectiveness of security testing, it also introduces significant ethical and security concerns, including the risk of adversarial misuse. This study explores the role of AI in offensive security, its applications, associated risks, and the emerging challenges of AI-driven cyber warfare.
The presentation "Keys to Freedom: Analysis and Resolution of Arab Ransom Locker Infections" explores the intricate workings of the Arab Ransom Locker malware, focusing on its impact on mobile devices. This session delves into a comprehensive analysis of the ransomware's attack vector, encryption mechanisms, and behavioral patterns. It will also provide a step-by-step guide to unlocking infected devices, including proven recovery techniques, decryption tools, and preventive strategies. Targeted at cybersecurity professionals and mobile device users, the presentation aims to equip attendees with actionable insights to understand, mitigate, and neutralize the threat posed by this malicious ransomware.
Firmware, essential to hardware functionality, increasingly becomes a prime target for cyber threat actors because of its foundational control over devices. This presentation delves into a detailed analysis of malware embedded within purported firmware updates for Sabrent devices, a case study revealing widespread exploitation. By leveraging advanced static and dynamic analysis techniques, we uncover the intricate workings of this malware, strategically hidden within seemingly legitimate firmware patches. Through meticulous investigation, including static examination for file headers, hashes, and embedded resources, and dynamic analysis within controlled environments, we decipher the malware’s operational stages. This includes its initial execution triggers, subsequent macro-driven deployments, and ultimate persistence mechanisms through registry modifications, all orchestrated to evade detection and ensure prolonged access to compromised systems.
Firmware, essential to hardware functionality, increasingly becomes a prime target for cyber threat actors because of its foundational control over devices. This presentation delves into a detailed analysis of malware embedded within purported firmware updates for Sabrent devices, a case study revealing widespread exploitation. By leveraging advanced static and dynamic analysis techniques, we uncover the intricate workings of this malware, strategically hidden within seemingly legitimate firmware patches. Through meticulous investigation, including static examination for file headers, hashes, and embedded resources, and dynamic analysis within controlled environments, we decipher the malware’s operational stages. This includes its initial execution triggers, subsequent macro-driven deployments, and ultimate persistence mechanisms through registry modifications, all orchestrated to evade detection and ensure prolonged access to compromised systems.
