Top Cybersecurity Instructors and Best Offers of the Year Available Now - Learn More!


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

SANS@MIC - WinSCP: Yeah you know me!

  • Monday, June 01, 2020 at 8:30 PM EDT (2020-06-02 00:30:00 UTC)
  • Mari DeGrazia

You can now attend the webcast using your mobile device!



This presentation covers the artifacts related to WinSCP. WinSCP has traditionally been associated with external access and exfiltration. However, with some recent changes to Windows 10, WinSCP is an attractive option for attackers to leverage to fly under the radar to conduct lateral movement. Join me on a trip through the 90s as we cover WinSCP and the forensic artifacts associated with it.

Speaker Bio

Mari DeGrazia

Mari DeGrazia brings her puzzle-solving skills to her position as Senior Director of Incident Response at Kroll Cyber Security, where she leads high-profile incident response cases and helps clients find and respond to attackers in their environment. In her role as a SANS instructor for FOR500: Windows Forensic Analysis, Mari draws on nearly 20 years of experience in the IT industry, including 10 years in Digital Forensics and incident Response (DFIR).

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.