Advanced DFIR Wizard Master Class
ADFIRWMC - 0. Disclaimers 0. Disclaimers ADFIRWMC - 1. Windows Remote Administration for Incident Responders Without a system administration background, many incident responders struggle with basic tasks like remotely starting and stopping processes on target machines. Inversely, Incident Responders with sysadmin experience ... ADFIRWMC - 2. Remote Acquisition of Windows Artifacts Some folks reading this are convinced that Incident Response is all done through Endpoint Detection and Response solutions and in 2018 no one drops collection scripts to gather artifacts for... ADFIRWMC - 3. Files of Forensic Interest Each and every one of these artifacts is a deep world of details all to themselves but I tried to boil them down for this list. We will cover most... ADFIRWMC - 4. The Value of Unstructured Analysis I find performing unstructured analysis upfront to be a critical part of my workflow because it tells me a massive amount of contextual data upfront and it focuses the structured... ADFIRWMC - 5.1 Did It Run? Evidence of Execution Welcome back. It has been a minute.