DFIR Summit 2016

iOS of Sauron: How iOS Tracks Everything You Do- SANS DFIR Summit 2016

iOS devices have the ability to track everything the user
does – how many steps the user takes, where the user has
been, and keeps track of how they use their devices.
This ...

[+] Show More

Now Playing

iOS of Sauron: How iOS Tracks Everything You Do- SANS DFIR Summit 2016

iOS devices have the ability to track everything the user does – how...

Now Playing

Using Endpoint Telemetry to Accelerate the Baseline - SANS DFIR Summit 2016

As the first boots-on-ground in a hostile environment, establishing a...

As the first boots-on-ground in a hostile environment, establishing a baseline or normalcy is a critical but timeconsuming task. Traditionally, this has been done by collecting system and network logs, ...

[+] Show More

Now Playing

Dive into DSL: Digital Response Analysis with Elasticsearch - SANS DFIR Summit 2016

Dive into DSL: Digital Response Analysis with Elasticsearch In this...

Dive into DSL: Digital Response Analysis with Elasticsearch

In this talk we will take a deep dive into the Elasticsearch DSL using python and how you can use it to go ...beyond the simple searches you may have been using in Kibana. We will demonstrate how Elasticsearch can be used to speed up and automate your DFIR investigations by grouping multiple queries of artifacts into a “signature of forensics” format to answer common investigator questions. In addition, this talk will explore the full power of elasticsearch’s searching and aggregation capabilities that can be utilized with indexed artifacts as well as the visualization functionality of Kibana. Use cases and code samples from real world investigations will be presented showing how you tap into this functionality already built into your ELK stack!

Brian Marks (@brianDFIR), Senior Associate, KPMG
Andrea Sancho Silgado, Associate, KPMG

Brian Marks

Brian is a senior associate with KPMG’s forensic technology practice in Chicago, IL. Brian has over five years of experience in the information security industry having worked for a Department of Defense contractor before joining KPMG. There he gained experience in intrusion detection, incident response, log analysis, firewall administration, and operating system auditing and hardening. At KPMG, he specializes in providing digital response services including incident response, digital forensics, reverse engineering, and threat intelligence. He has provided these services for clients in many various industries including multinational businesses and Fortune Global 100 organizations.

Andrea Sancho Silgado

Andrea is an associate in the Chicago, IL office of KPMG U.S. Andrea has been a member of the forensic technology team since 2014, focusing on providing forensic services, threat intelligence, and incident response to clients, including Fortune 500 organizations. She also assists developers in the forensic technology team with coding between projects. Andrea
is constantly aspiring to study and learn more in the DFIR field. In her first year as a professional, Andrea completed the certifications for GCFA and EnCase Certified Examiner. Prior to joining KPMG, she studied telecommunications engineering at Universidad Politecnica de Madrid, Spain. In the fifth year of her studies, she enrolled in a double degree program with Illinois Institute of Technology completing a Master of Science in Electrical Engineering in one year.

[+] Show More

Now Playing

The Incident Response Playbook for Android and iOS - SANS DFIR Summit 2016

The Incident Response Playbook for Android and iOS What is your mobile...

Now Playing

Hadoop Forensics - SANS DFIR Summit 2016

Hadoop Forensics Nowadays it seems that everyone from businesses to...

Now Playing

Rocking your Windows EventID with ELK Stack - SANS DFIR Summit 2016

We have thousands of possible windows events id, split into 9...

We have thousands of possible windows events id, split into 9 categories and 50+ subcategories that logs all actions in a windows machine as login/logoff, process creation, modifications, packet filtering ...

[+] Show More

Now Playing

Who Watches the Smart Watches? - SANS DFIR Summit 2016

Who Watches the Smart Watches? Wearable technology use has accelerated...

Now Playing

Tracking Threat Actors through YARA Rules and Virus Total - SANS DFIR Summit 2016

One of the largest challenges in incident response and security...

Now Playing

Expanding The Hunt: A Case Study in Pivoting Using Passive DNS and Full PCAP - SANS DFIR Summit 2016

Hunt teams increasingly are building redundancy into their...

Hunt teams increasingly are building redundancy into their investigations to detect and respond to cyberattacks. Cross-Customer Correlation is a process where hunt teams pivot from one set of indicators from ...a customer into other customer networks to find threats, anomalies and other attack patterns they may have missed in their initial investigations. In this presentation, Farsight Security CEO Dr. Paul Vixie and ProtectWise CTO Gene Stevens will present a compelling case study focused on how ProtectWise used Farsight’s historical passive DNS information to pivot from threat indicators found in one customer’s network to uncover a previously undetected attack in a second customer’s network.

Gene Stevens, (@genestevens) CTO, ProtectWise
Dr. Paul Vixie (@paulvixie), CEO, Farsight Security

Dr. Paul Vixie
(@paulvixie), CEO, Farsight Security
Dr. Paul Vixie is the CEO of Farsight Security, Inc. In 2014, he was inducted into the Internet Hall of Fame for his work related to DNS. Previously, he served as president, chairman and founder of Internet Systems Consortium (ISC), as president of MAPS, PAIX, and MIBH, as CTO of Abovenet/MFN, and on the board of several for-profit and non-profit companies. He served on the ARIN board of trustees from 2005 to 2013, and as chairman in 2008 and 2009. Dr. Vixie is a founding member of ICANN Root Server System Advisory Committee (RSSAC) and ICANN Security and Stability
Advisory Committee (SSAC). He has been contributing to Internet
protocols and UNIX systems as a protocol designer and software architect since 1980. He is considered the primary author and technical architect of BIND 8. He earned his Ph.D. from Keio University for work related to DNS and DNSSEC.

Gene Stevens
Chief Technology Officer, ProtectWise
Gene Stevens drives the technology vision and architecture for ProtectWise. He has more than 20 years experience in software development, cloud computing, security as a service, and distributed systems. Prior to founding ProtectWise, Gene was the founder and CTO at TagLabs, a mobile tagging company. He was a principal software engineer at McAfee, cloud and content security and has also held engineering roles at MX Logic and GDX. Early in his career, Gene developed financial forecasting, market analysis, and service capacity planning software for Hewitt Associates (Aon).

[+] Show More

Now Playing

Analyzing Dridex, Getting Owned by Dridex, and Bringing in the New Year with Locky

Analyzing Dridex, Getting Owned by Dridex, and Bringing in the New Year...

Now Playing

What Would You Say You Do Here?: Redefining the Role of Intelligence in Investigations

What Would You Say You Do Here?: Redefining the Role of Intelligence in...

Now Playing

Defending a Cloud - SANS DFIR Summit 2016

What makes cloud platforms unique – and uniquely difficult to defend?...