Building the SANS ICS Summit Capture the Flag (CTF) Competition

SANS and Dragos hosted an ICS-themed Capture The Flag (CTF) for the 2022 SANS ICS Summit using a fictional attack on a pipeline operator as a backstory. The CTF presented challenges across ransomware analysis, ICS protocol PCAP analysis, Windows event log analysis, memory forensics, and engineering/network diagram review to teach ICS incident response and adversary TTPs to over 700 participants.