SANS Digital Forensics and Incident Response Blog: Category - apt

Threat Hunting and Incident Response Summit - CFP - Closing 12 Oct

The inaugural Threat Hunting and Incident Response Summit will be held in New Orleans, LA on April 12- 13, 2016. The Threat Hunting & Incident Response Summit 2016 focuses on specific hunting and incident response techniques and capabilities that can be used to identify, contain, and eliminate adversaries targeting your networks. Attend this summit … Continue reading Threat Hunting and Incident Response Summit - CFP - Closing 12 Oct


Monitoring for Delegation Token Theft

Delegation is a powerful feature of Windows authentication which allows one remote system to effectively forward a user's credentials to another remote system. This is sometimes referred to as the "double-hop". This great power does not come without great risk however, as the delegation access tokens used for this purpose can be stolen by attackers … Continue reading Monitoring for Delegation Token Theft


Announcing the GIAC Network Forensic Analyst Certification - GNFA

A new security certification focused on the challenging field of network forensics BETHESDA, MD - October 7, 2014- Global Information Assurance Certification (GIAC) is pleased to announce a new forensics certification, the GIAC Network Forensic Analyst (GNFA). The GNFA validates that professionals who hold this credential are qualified to perform examinations employing network forensic artifact … Continue reading Announcing the GIAC Network Forensic Analyst Certification - GNFA


Deadline Approaching - APT Malware and Memory Challenge #DFIRCON

DEADLINE 31 Jan 2014 — Winner Announced - 3 Feb 2014 DFIRCON APT Malware & Memory Challenge The memory image contains real APT malware launched against a test system.Your job? Find it. The object of our challenge is simple: Download the memory image and attempt to answer the questions. To successfully submit for the contest, … Continue reading Deadline Approaching - APT Malware and Memory Challenge #DFIRCON


APT Malware and Memory Challenge

The memory image contains real APT malware launched against a test system. Your job? Find it. The object of our challenge is simple: Download the memory image and attempt to answer the 5 questions. DOWNLOAD LINK FOR MEMORY IMAGE:http://dfir.to/APT-Memory-Image Questions: What is the Process ID of the rogue process on the system? Determine the name … Continue reading APT Malware and Memory Challenge