Event banner
Event details
For someone who is trying to build out their internal DFIR capabilities, what are a few key areas you would recommend they focus on? What are your thoughts on live triage vs traditional forensics (disk images etc.)?
Jamesmoe
Microsoft
MicrosoftIdentity is the mechanism by which most attacks execute on their objectives. They may get in several different ways; however, the real question is how did they privilege escalate from a normal user to a privileged user? So making sure you are implementing identity detections is key to stitching together the various artifacts into a true attack timeline.