DFIR Open Mic Night

So, here's a thought...

At a well-attended DFIR conference, there should be a DFIR open mic comedy night.  In the evening, after the event is done for the day, use the venue for something a little light-hearted. For example, OSDFCon has had a mixer at the end of one of the days, where there've been finger foods and adult beverages, and there's a bar right there in the lobby.  Since the venue already has chairs and a mic, why not use them? 

So, Chatham House rules apply, as well as:

• No sales pitches
• No shaming anyone, any company or organization, product, etc.
• Use no names, unless you're sending praise/shout-outs
• Be cool - a little light profanity isn't an issue, but don't be vulgar or disgusting

I think a lot of folks would enjoy something like this...it's a great way to engage, and provide some folks who maybe didn't get their talk accepted a chance to get up on stage and see how they do with public speaking.

After all, there are a LOT of weird or funny things that go on during an IR engagement.  Some may not be funny at the time, but with a little embellishment ("don't let the facts get in the way of a good story...") some time later, they're freakin' hilarious!  So why not share these with everyone else?

For example, I did an IR years ago with a global organization, one that had multiple tools available.  We'd seen Mimikatz being run in the environment; in fact, the SOC (which was located in another country) had alerted the headquarters organization to this finding.  A manager in charge of one the other tools was running searches for "mimikatz" across the infrastructure; unfortunately, one of the detections being used was, "any command line that includes "mimikatz"".  This was intended to catch things like "Invoke-Mimikatz", but it caught everything else.  The first couple of times this happened, the SOC would send an alert, and the local SOC manager (a guy about 6' 7", 275 lbs, bodybuilder type) would go nuts, telling (well, not "telling", per se...) us that the bad guy was back, while the veins in his head and neck were popping out.

So, not funny at the time, but something we can laugh about now...

Thoughts?  Go?  No go?  Is this something you'd participate in, or just want to watch?  Or watch until maybe you got your nerve up (liquid courage) and then got up on stage?