Online Training Special Offer: iPad Air w/ Smart KB, Surface Go, or $300 Off

Webcasts

To attend this webcast, login to your SANS Account or create your Account.

Detecting Evil on Windows Systems - An In-Depth Look at the DFIR Poster

  • Thursday, April 03, 2014 at 11:00 AM EDT (2014-04-03 15:00:00 UTC)
  • Mike Pilkington, Rob Lee

You can now attend the webcast using your mobile device!

  

Overview

In an intrusion case, spotting the difference between abnormal and normal is often the difference between success and failure. Your mission is to quickly identify suspicious artifacts in order to verify potential intrusions. This year, SANS released a brand new poster and cheat sheet aimed at forensic and SOC analysts, system administrators, and security engineers to help identify evil on Windows.

This webcast will step through the information found on the new DFIR poster and discuss why we felt it was important to include that information to help identify adversaries inside your Windows enterprise. We will demonstrate how to use the information in the poster to identify good from bad. This poster release has been one of the most requested cheat sheets and posters we have had for years. Listen in to find out how to obtain a poster and to display it on a wall where it could truly make a difference in helping your analysts detect evil.

Speaker Bios

Rob Lee

Rob Lee is the Chief Curriculum Director and Faculty Lead at the SANS Institute where he oversees the Digital Forensics, Incident Response, Cloud, Pen Testing, Audit, Application Security, and Cyber Defense curricula along with other operational functions in the company. With more than 24 years of experience in computer forensics, vulnerability and exploit discovery, intrusion detection/prevention, and incident response, he provides consulting services in the Washington, D.C. area. Before starting his own business, Rob worked with government agencies in the law enforcement, defense and intelligence communities as a lead forvulnerability discovery and exploit development teams, a cyber forensics branch, and a computer forensic and security software development team.

Rob graduated from the U.S. Air Force Academy and served in the U.S. Air Force as a founding member of the 609th Information Warfare Squadron, the first U.S. military operational unit focused on information operations. Later, he was a member of the Air Force Office of Special Investigations (AFOSI) where he led a team conducting computer crime investigations, incident response, and computer forensics. Prior to starting his own firm, he directly worked with a variety of government agencies, U.S. Department of Defense, and intelligence communities as the technical lead for a vulnerability discovery and an exploit development team, lead for a cyber forensics branch, and lead for a digital forensic and security software development team. Rob was also a directorfor MANDIANT, a company focused on investigating advanced adversaries, such as the APT, for five years prior to starting his own business. Rob co-authored the book Know Your Enemy, 2nd Edition. Rob earned his MBA from Georgetown University in Washington DC. Rob is also a co-author of the MANDIANT threat intelligence report M-Trends: The Advanced Persistent Threat.


Mike Pilkington

Mike Pilkington is a Senior Security Consultant for a Fortune 500 company in the oil & gas industry. He has been an IT professional since graduating in 1996 from the University of Texas with a B.S. in Mechanical Engineering. Since joining his company in 1997, he has been involved in software quality assurance, systems administration, network administration, and information security. Outside of his normal work schedule, Mike has also been involved with the SANS Institute as an instructor in the Digital Forensics and Incident Response program.

Need Help? Visit our FAQ page or email webcast-support@sans.org.

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.