Start-Process PowerShell: Get Forensic Artifact- SANS DFIR Summit 2016
The increasing size of Hard Disk Drives presents a growing problem for the digital forensics field. It is no longer feasible to investigate every artifact on every host in the environment when a compromise occurs. Lucky for us, nearly all disk-based artifacts have a timestamp associated with them, which can be used to build a forensic timeline. This timeline can be used to narrow the scope of the investigation, allowing analysts to quickly triage events related to the compromise.
Fortunately, this can all be accomplished without purchasing any expensive tools by leveraging PowerShell and its access to the Windows API and .NET framework. PowerForensics provides Digital Forensics/Incident Response community with an all in one toolset for
attack investigation, providing a forensically sound “live” investigation platform without the need to image the hard drive. This presentation will cover the background and overview of PowerForensics, including how its new Forensic Timelining capability can facilitate the investigation of advanced actors at scale. Finally, I’ll cap off with a complex demo, showing how PowerForensics can help blue teams investigate the real attacks they’re currently facing.
Jared Atkinson (@jaredcatkinson), Hunt Capability Lead, Veris
Group’s Adaptive Threat Division
Jared Atkinson
(@jaredcatkinson), Hunt Capability Lead, Veris Group’s Adaptive Threat Division Jared Atkinson is the hunt capability lead with Veris Group’s adaptive threat division. Before working for Veris Group, Jared spent four years leading incident response missions for the U.S. Air Force Hunt Team, detecting and removing advanced persistent threats on Air Force and DoD networks. Passionate about PowerShell and the open-source community, Jared is the
lead developer of the PowerForensics project, an open-source forensics framework for PowerShell, and maintains a DFIR-focused blog