DFIR Summit 2020

Help! We need an adult! Engaging an external IR team w/ Liz Waddell - SANS DFIR Summit 2020

Too often, the decision to bring in a third-party forensic team occurs when an incident has reached crisis level. As an Incident Commander for such a team, Liz has seen ...

[+] Show More

Now Playing

Help! We need an adult! Engaging an external IR team w/ Liz Waddell - SANS DFIR Summit 2020

Too often, the decision to bring in a third-party forensic team occurs...

Now Playing

Kansa for Enterprise scale Threat Hunting w/ Jon Ketchum - SANS DFIR Summit 2020

Over the past 2 years our threat hunting team has made significant...

Over the past 2 years our threat hunting team has made significant improvements to the open-source Kansa project. As an IR/Hunt powershell framework it is a great tool, but it ...

[+] Show More

Now Playing

Extract and Visualize Data from URLs using Unfurl w/ Ryan Benson - SANS DFIR Summit 2020

Unfurl takes a URL and expands ("unfurls") it into a directed graph,...

Unfurl takes a URL and expands ("unfurls") it into a directed graph, extracting every bit of information from the URL and exposing the obscured. It does this by breaking up ...

[+] Show More

Now Playing

Making Memories: Using Memory Analysis for Faster Response to User Investigations - SANS DFIR Summit

What if there was a better way? What if examiners could get to critical...

Now Playing

Healthy Android exams: Timelining digital Wellbeing data

The digital Wellbeing database in Android devices helps users keep...

Now Playing

Forensic Analysis of Apple HomePod & Apple HomeKit Environment w/ Mattia Epifani - SANS DFIR Summit

The Apple HomeKit is an Apple protocol that allows users to communicate...

The Apple HomeKit is an Apple protocol that allows users to communicate with and control connected accessories in their home using the Home App installed on an iPhone or an ...

[+] Show More

Now Playing

capa: Automatically Identify Malware Capabilities w/ Ballenthin & Moritz Raabe - SANS DFIR Summit

Effective analysts are those that understand and prioritize files of...

Effective analysts are those that understand and prioritize files of interest during an incident response. However, understanding if a program is malicious, the role it plays during an attack, and ...

[+] Show More

Now Playing

Using Big DFIR Data in Autopsy and Other Tools w/ Brian Carrier - SANS DFIR Summit 2020

All industries are learning about how to leverage "big data" to make...

Now Playing

Just Forensics, Mercifully w/ Lee Whitfield - SANS DFIR Summit 2020

Most seasoned forensicators have done some significant things over the...

Now Playing

Did I do that? - Understanding action & artifacts w/ Matthew Seyer & David Cowen - SANS DFIR Summit

By default, when we look at forensic artifacts, the action has already...

By default, when we look at forensic artifacts, the action has already occurred. Have you ever been curious what an action or application would leave behind and how it would ...appear in your forensics tools? Or, maybe you have seen something in a forensic artifact and wondered what caused it. So many artifacts and so many questions!

Tools like Process Monitor have always assisted in exploring how applications and actions impact the file system. The forensic challenge arises though when you want to see changes to binary structures or internals that are contained within files or registry values to better associate an action to an artifact. For example, answering questions like, “How can an executable have been run by a user without updating the run count?”

What if there was a way to see artifact data change, to connect the dots between what we see left behind in artifacts, and the actions that caused it? In this talk you will learn how to utilize the Windows API to view changes in forensic artifacts in real-time and better understand how actions generate forensic data. We will also demonstrate NEW (and FREE) tools and techniques to enable this type analysis.

Matthew Seyer, @forensic_matt, Manager, KPMG
David Cowen, @HECFBlog, Managing Director, KPMG #instructor

The annual SANS Digital Forensics & Incident Response (DFIR) Summit is the most comprehensive DFIR event of the year, bringing together a passionate and influential group of experts, cutting edge research and tools, immersive training, and industry networking opportunities. Learn more about this event at https://www.sans.org/event/digital-forensics-summit-2020

DFIRCON 2020 - Live Online
sans.org/event/dfircon-2020-live-online
Virtual, US Eastern | Mon, Nov 2 - Sat, Nov 7, 2020

Courses Available:
FOR308: Digital Forensics Essentials - NEW
FOR498: Battlefield Forensics & Data Acquisition
FOR500: Windows Forensic Analysis
FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
FOR518: Mac and iOS Forensic Analysis and Incident Response
FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response
FOR578: Cyber Threat Intelligence
FOR585: Smartphone Forensic Analysis In-Depth
FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

[+] Show More

Now Playing

You need a PROcess to check your running processes and modules w/ Michael Gough - SANS DFIR Summit

You need a PROcess to check your running processes and modules. The bad...

You need a PROcess to check your running processes and modules. The bad guys, and red teams are coming after them!

If there is a file on disk, you can easily ...SEE the bad fu, but what if the malware is nowhere to be found on the disk? Malware can be broken up into several types, some call it "fileless malware" (poor non-descript term). The malware really isn’t fileless, the file, or code lives somewhere, the registry, WMI database, or the focus of this talk, in memory. This talk will focus on Memware that has been injected into memory, most likely injected a process or added a DLL and may not reside on disk while the system is running.

Do you have a PROcess to detect, investigate, respond, and/or hunt for Memware?

This talk will walk through some commodity and Red Team examples of how this works and what you can do to address this newly expanding threat that is becoming more and more common in commodity malware, Red Team engagements, and of course APT attackers, because it can avoid so many security tools. Attendees will leave with some ideas and tools that can help you detect, investigate and hunt for Memware.

Michael Gough, @MichaelGoughTX, Principal Incident Response, NCC Group

The annual SANS Digital Forensics & Incident Response (DFIR) Summit is the most comprehensive DFIR event of the year, bringing together a passionate and influential group of experts, cutting edge research and tools, immersive training, and industry networking opportunities. Learn more about this event at https://www.sans.org/event/digital-forensics-summit-2020

DFIRCON 2020 - Live Online
sans.org/event/dfircon-2020-live-online
Virtual, US Eastern | Mon, Nov 2 - Sat, Nov 7, 2020

Courses Available:
FOR308: Digital Forensics Essentials - NEW
FOR498: Battlefield Forensics & Data Acquisition
FOR500: Windows Forensic Analysis
FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
FOR518: Mac and iOS Forensic Analysis and Incident Response
FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response
FOR578: Cyber Threat Intelligence
FOR585: Smartphone Forensic Analysis In-Depth
FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

[+] Show More

Now Playing

Hunting bad guys that use TOR in real-time w/ Milind Bhargava - SANS DFIR Summit 2020

As cybercrime has become commonplace, Tor has been the tool of choice...

As cybercrime has become commonplace, Tor has been the tool of choice for attackers due to the inherent anonymity it provides. But what if you, an Incident Responder, could acquire ...

[+] Show More