In an intrusion case, spotting the difference between abnormal and normal is often the difference between success and failure. Your mission is to quickly identify suspicious artifacts in order to verify potential intrusions. This year, SANS released a brand new poster and cheat sheet aimed at forensic and SOC analysts, system administrators, and security engineers to help identify evil on Windows.
This webcast will step through the information found on the new DFIR poster and discuss why we felt it was important to include that information to help identify adversaries inside your Windows enterprise. We will demonstrate how to use the information in the poster to identify good from bad. This poster release has been one of the most requested cheat sheets and posters we have had for years. Listen in to find out how to obtain a poster and to display it on a wall where it could truly make a difference in helping your analysts detect evil.