+ All Categories

Home > Documents > Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re...

Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re...

Date post:	30-Jan-2020
Category:	Documents
Upload:	others
View:	4 times
Download:	0 times

Download Report this document

Share this document with a friend

Embed Size (px):

37

Kathryn Hedley [email protected]

Transcript

Page 1: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Kathryn [email protected]

Page 2: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 3: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 4: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

≠

Page 5: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Avoiding wheel re-invention where possible

Page 6: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 7: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

(some rows removed)

Page 8: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 9: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 10: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 11: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 12: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

How good are existing tools?

Page 13: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 14: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 15: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

??

Page 16: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 17: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

https://www.khyrenz.com/blog/sysprofiler/https://github.com/khyrenz/sysprofiler

Page 18: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

§ Understand disk image, extract files

§ Run existing Registry parsers

§ Extract specific Registry keys/values where required

Page 19: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 20: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 21: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 22: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 23: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 24: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 25: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 26: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 27: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 28: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 29: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 30: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 31: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 32: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 33: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 34: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 35: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 36: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Page 37: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

https://www.khyrenz.com/blog/sysprofiler/https://github.com/khyrenz/sysprofiler

Recommended

Patriot Patriot, Patriot Plus LecternsSS3040 Patriot Lectern with Sound System 195 lbs 325 lbs $5,212.00 SN3040 Patriot Lectern 175 lbs 300 lbs $4,538.00 SW3045 Wireless Patriot Plus

Galloway Patriot

Patriot Loyalist

Patriot Offense

PATRIOT - BONKOTE

Covering: Lawrence, Methuen ... - The Valley Patriot · Valley Patriot *Editorial* OPINIONS 2006 Valley Patriot Ad Rates2006 Valley Patriot Ad Rates Color Pages add $100.00 - Insert

Patriot Single Tank Product Manual - diamondh2o.com€¦ · Patriot Series Single Tank Product Manual pg. 1 Figure 6: Brine Line Hose, Control valve packaging, Brine Line ‘T’

CALOOSA PATRIOT

Patriot Transportation Holding, Inc.patriottrans.com/InvestorPresentations/BBT Tank... · BB&T Capital Markets Conference – February 10-11, 2016 . Patriot Transportation Holding,

Patriot Campers -

The Patriot File, Unearthed - Schiller Institute · The Patriot File, Unearthed by Anton ... Secretary of War John C. Calhoun, and Samuel Gouverneur, son-in ... Williams sets up his

CEC301a_30566_Dixie Patriot