Diamonds are a Forensicator's Best Friend - Intelligence Support for DFIR
summary
Shows how CTI directly guides DFIR by turning artifacts into testable hypotheses: use the diamond model and a FEED/F3EAD-style loop to prioritize searches, run targeted Splunk and Log2Timeline queries, and perform file carving guided by observed filenames and Windows Event ID 4663. Covers concrete anti-forensics cases (APT29 timestomping, Aquatic Panda deleting executables, Sunburst disabling auditpol and temporary firewall rules) and gives practical checks to assess visibility and ensure eradication. anti-forensics visibility testing
AI-written summary · about
chapters (9)
- 0:00Introduction and scope
- 2:18Intelligence in operations
- 3:54The intelligence process
- 7:23Hunting within response
- 9:57Diamond model application
- 15:58Optimizing collaboration
- 18:19Handling anti-forensics
- 21:51Forensic case studies
- 27:46Metrics and conclusion
related talks
14mDFIR - Don't Forget Your Roots!
28mA Diamond is an Analysts Best Friend Introducing the Diamond Model for Influence Operations Analysis
32mUnlocking Insights: The Role of TI in Modern DFIR Operations
31mBringing Chronological Context to Disparate Artifacts: Accelerating Digital Forensics
46mDigital Forensics – The Importance of Forensic Triage Images
34mA Blueprint for Detection Engineering: Tools, Processes, and Metrics
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program