The Light Side of the Force: PowerShell for Incident Handlers
With all the talk about using PowerShell for offense, it's time to give incident response teams a dose of the force and illustrate ways in which PowerShell can make your life easier. Get a PowerShell primer and learn how to build system baselines, threat hunt, look for indicators of compromise, efficiently parse event logs, and automate many other network defense operations. Additional details available at www.AppliedIncidentResponse.com.
Steve Anson, SANS Instructor
Steve Anson is a Director with Forward Defense, a leading IT security and incident response company headquartered in Abu Dhabi. Previously, he served as a special agent with the US Department of Defense and on an FBI Cyber Crime Task Force, leading complex investigations into cyber-related offences including network intrusion incidents, terrorism, fraud and crimes against children. Steve also served as an instructor at the FBI Academy and for the US Department of State, providing network intrusion investigation and digital forensics training to thousands of students from US law enforcement agencies as well as national police, prosecutors and judges from dozens of countries.
Throughout his career, Steve has received a number of industry credentials, including Certified Information Systems Security Professional (CISSP), EnCase Certified Examiner (EnCE), Cellebrite Certified Mobile Examiner (CCME), US Department of Defense Certified Computer Crime Investigator and US Federal Law Enforcement Training Center Seized Computer Evidence Recovery Specialist (SCERS). He has served as an Adjunct Professor for George Washington Universitys Master of Computer Forensics program, is a certified Lead Assessor for laboratory competence in ISO 17025:2005 with the American Association for Laboratory Accreditation, and is the co-author of Mastering Windows Network Forensics and Investigations from Wiley Publishing.
For more information: https://www.sans.org/talks/915/double-feature-wellington-2018-09-05
September 5, 2018 (5:30 - 8:00 pm)