Webcast: Think You're Compromised? What Do We Do Next?

In this webcast, we will cover what we can do if we think there is a breach on our network. We will cover live forensics, cool PowerShell scripts, network, and event log analysis, cool IR spreadsheets, and checklists. We will also be covering the status of our ELK project for reviewing Event ID 3 from Sysmon. So, a lot… Yep… A crazy amount. Download slides: https://www.activecountermeasures.com/presentations 00:00 – Intro 00:47 – “Ok, But Why” 02:17 – Have It The Wrong Way 04:35 – Have It The Right Way 06:58 – Lego My Incident Response 08:25 – Monologging On Mute 11:57 – Wouldn’t Be Prudent 14:29 – “Better Than Bad, It’s Good” 21:33 – A Van Full of Free Tools 44:10 – CSI: Memory 45:01 – We Got Cheat Sheets if You Want Some Cheat Sheets 47:20 – Overlapping Venn Diagrams 49:46 – Questions in the Wild 59:15 – Sucking at Capitalism Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 2,052 other subscribers

• (00:00) - Intro
• (01:18) - Ok, But Why
• (02:49) - Have It The Wrong Way
• (05:07) - Have It The Right Way
• (07:30) - Lego My Incident Response
• (08:56) - Monologging On Mute
• (12:28) - Wouldn't Be Prudent
• (15:00) - Better Than Bad, It's Good
• (22:04) - A Van Full of Free Tools
• (44:41) - CSI: Memory
• (45:32) - We Got Cheat Sheets if You Want Some Cheat Sheets
• (47:51) - Overlapping Venn Diagrams
• (50:17) - Questions in the Wild
• (59:46) - Sucking at Capitalism