Getting Started - Help Me Help You

Learn essential incident response techniques and tools in this 55-minute conference talk from BSides Detroit 2015. Explore live memory analysis, system investigation methods, and key tools like WinPM and ELF. Discover how to handle various scenarios, from consulting firm realities to playing the odds in incident response. Gain insights into processor architecture, system types, and environment variables. Dive into real-time scanning, registry analysis, and event log examination. Master the use of PSLogList and TR3 scripts for effective incident handling. Enhance your cybersecurity skills with practical knowledge from experienced professionals in the field.

Intro
Disclaimer
Agenda
Friday Night
Homeboys
Be Cool
Incidents Never Happen
Consulting Firm
Reality Checks
Playing the Odds
Running Memory
List of Tools
Live Memory
Admin Access
Processor Architecture
System Type
Desktop Directory
Environment Variable
RealTime Scanning
WinPM
WinPM Speed
Boss
Memory
Registry
WindPMM
Elf
The slowest part
USB hard drives
Venn diagram
Page Files
Extract
EMF
CrowdStrike
Raw Copy
User Class
Event Log
PSLogList
Recap
TR3 Script
Virgin Young