Mohammad Alattas
Senior Cyber Threat Intelligence
Riyad Bank
Mohammad Alattas is a Senior Threat Intelligence Specialist at Riyad Bank. Currently he is building the bank's CTI function: integrating sources, automating workflows, and producing operational, tactical and strategic reporting for investigation teams. Before that he spent nearly three years as a SOC analyst at Kaspersky, focused on detecting advanced threats, writing custom detection logic and developing AI-based tooling to support incident response. He also co-founded Threat Monitor, a Saudi threat intelligence SaaS startup offering dark web monitoring and brand protection.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
APISignature: Windows API Docs, Malware Abuse Context and capa Rules Inside x64dbg
Every malware analyst working in a debugger has the same loop: land on an API call, alt-tab to a browser, search Microsoft's docs, open malapi.io to see how it's abused, maybe check capa rules, then come back and try to remember what they were doing. On an isolated analysis VM with no internet, that loop breaks entirely.
APISignature is an open-source x64dbg/x32dbg plugin that removes that loop. Select any call in the debugger and a docked panel fills in Microsoft's official documentation for 44,000+ Windows and driver APIs, malapi.io's malicious-use description and attack category (Injection, Evasion, Spying, Ransomware, Anti-Debugging, Enumeration, Internet, Helper), and the capa rules the API participates in, with the rule members already present in the target highlighted against those that aren't. A "Capabilities" button matches the imports of every loaded module against capa's rule set to answer "what can this sample do?" in one click, and can be re-run after a sample unpacks to surface what's new. Full-text search across the entire corpus is available from inside the debugger.
The plugin is fully offline: one DLL and one SQLite index, no network, no Python, no second process. An optional MCP server ships alongside it so an AI assistant can query the same index rather than AI hallucination by providing a ground truth reference specially when we are talking about undocumented API's.
The demo will walk through a live unpacking and injection sample, showing how the panel and Capabilities view change as the sample reveals itself.
- 13:00
- Tue
- 01 Dec
Stage:
Arsenal 3
Sessions Type:
Keynote