+ All Categories

Download - Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Transcript
Page 1: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Kathryn [email protected]

Page 2: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 3: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 4: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

≠

Page 5: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

Avoiding wheel re-invention where possible

Page 6: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 7: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

(some rows removed)

Page 8: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 9: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 10: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 11: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 12: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

How good are existing tools?

Page 13: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 14: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 15: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

??

Page 16: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 17: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

https://www.khyrenz.com/blog/sysprofiler/https://github.com/khyrenz/sysprofiler

Page 18: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

§ Understand disk image, extract files

§ Run existing Registry parsers

§ Extract specific Registry keys/values where required

Page 19: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 20: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 21: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 22: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 23: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 24: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 25: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 26: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 27: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 28: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 29: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 30: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 31: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 32: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 33: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 34: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 35: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 36: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with
Page 37: Kathryn Hedley khedley@khyrenz - SANS Institutereport_ne two rks t Ing file; t . file to this re file - file by . this . seria Firs Lis t patriot FMAP patriot 2018-08-18114: play with

https://www.khyrenz.com/blog/sysprofiler/https://github.com/khyrenz/sysprofiler


Top Related
Galloway Patriot
Galloway Patriot

Documents

Patriot 2015
Patriot 2015

Documents

Patriot Quest
Patriot Quest

Documents

Patriot Express
Patriot Express

Documents

THE BADGER PATRIOT - Squarespacestatic1.squarespace.com/static/574a43ef2eeb81625af35d60/t/574a8def...mander; John Dyrud, ... (Co-Editor Win Williams was unable to ... The Badger Patriot
THE BADGER PATRIOT - Squarespacestatic1.squarespace.com/static/574a43ef2eeb81625af35d60/t/574a8def...mander; John Dyrud, ... (Co-Editor Win Williams was unable to ... The Badger Patriot

Documents

PATRIOT - BONKOTE
PATRIOT - BONKOTE

Documents

Patriot Act
Patriot Act

Documents

CALOOSA PATRIOT
CALOOSA PATRIOT

Documents