This session dives into critical host-based technologies and practices that form the foundation of modern security monitoring. Drawing on experience as a hobbyist malware researcher, I’ll explore how host-based intrusion detection, antimalware, and firewalls use signatures, rules, and predictive AI to defend endpoints. Along the way, we’ll examine OS components, logs, and malware analysis outputs, tying it all back to attribution, evidence handling, and recognizing indicators of compromise and a