DFIR - Don't Forget Your Roots!
summary
Shares concrete repeatable work: built a Cobalt Strike lab and a post‑exploit server to learn real C2 behaviors; spins up a webserver plus a misconfigured REST API backed by a test database to reproduce API abuse; automates forensic collection across ~250 Windows assets to avoid running KAPE everywhere; performs rapid network segregation and mounts Azure blob storage into analysis VMs, a trick that halves analysis time on evidence triage.
AI-written summary · about
chapters (11)
- 0:00Introduction to DFIR roots
- 1:47Speaker background and path
- 3:52Mock incident scenario
- 4:54Thinking like an admin in DFIR
- 6:40C2 infrastructure understanding
- 7:40Learning applications for DFIR
- 8:42API misconfigurations in incidents
- 9:24Build to understand DFIR
- 10:30Q&A on application security
- 11:53Learning through hands-on experience
- 13:15DFIR learning and communication
related talks
36mBeing A Better Defender By Channeling Your Worst Adversary:
01h 00mStories from NC3 - investigating hackers
53mForensics Skillset: Techniques for Extraction and Analysis of the Evidence
39mCSI Container: Can You DFIR It?
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
01h 06mHow hacking works
27m“Why are they asking me to do this?” or Adventures in IR Land
31mDiamonds are a Forensicator's Best Friend - Intelligence Support for DFIR