DFSP # 428 - It’s All About That XML Digital Forensic Survival podcast

Artwork

Data Science Michael I Talk Science Tech Digital Forensic Survival

Innhold levert av Michael and Digital Forensic Survival Podcast. Alt podcastinnhold, inkludert episoder, grafikk og podcastbeskrivelser, lastes opp og leveres direkte av Michael and Digital Forensic Survival Podcast eller deres podcastplattformpartner. Hvis du tror at noen bruker det opphavsrettsbeskyttede verket ditt uten din tillatelse, kan du følge prosessen skissert her https://no.player.fm/legal.

Digital Forensic Survival Podcast « »
DFSP # 428 - It’s all about that XML

5M ago 27:32

Del

MP4•Episoder hjem

Innhold levert av Michael and Digital Forensic Survival Podcast. Alt podcastinnhold, inkludert episoder, grafikk og podcastbeskrivelser, lastes opp og leveres direkte av Michael and Digital Forensic Survival Podcast eller deres podcastplattformpartner. Hvis du tror at noen bruker det opphavsrettsbeskyttede verket ditt uten din tillatelse, kan du følge prosessen skissert her https://no.player.fm/legal.

When you're triaging a Windows system for evidence of compromise, it's ideal if your plan is focused on some quick wins upfront. There are certain artifacts that offer this opportunity, and Windows Events for New Scheduled Tasks are one of them. Sometimes overlooked, at least in part, because the good stuff contained within the XML portion of the log. This week I'm covering the artifact from a DFIR point of view, I'll go over all the elements of the log entry that are of interest for investigations, and I'll provide a triage methodology that you can employ to find evidence quickly.

… continue reading

451 episoder

#Data Science #Michael #I Talk #Science #Tech #Digital Forensic Survival

Artwork

DFSP # 428 - It’s all about that XML

Digital Forensic Survival Podcast

155 subscribers

published 5M ago

Del

MP4•Episoder hjem

Innhold levert av Michael and Digital Forensic Survival Podcast. Alt podcastinnhold, inkludert episoder, grafikk og podcastbeskrivelser, lastes opp og leveres direkte av Michael and Digital Forensic Survival Podcast eller deres podcastplattformpartner. Hvis du tror at noen bruker det opphavsrettsbeskyttede verket ditt uten din tillatelse, kan du følge prosessen skissert her https://no.player.fm/legal.

When you're triaging a Windows system for evidence of compromise, it's ideal if your plan is focused on some quick wins upfront. There are certain artifacts that offer this opportunity, and Windows Events for New Scheduled Tasks are one of them. Sometimes overlooked, at least in part, because the good stuff contained within the XML portion of the log. This week I'm covering the artifact from a DFIR point of view, I'll go over all the elements of the log entry that are of interest for investigations, and I'll provide a triage methodology that you can employ to find evidence quickly.

… continue reading

451 episoder

#Data Science #Michael #I Talk #Science #Tech #Digital Forensic Survival

All episodes

×

Velkommen til Player FM!

Player FM scanner netter for høykvalitets podcaster som du kan nyte nå. Det er den beste podcastappen og fungerer på Android, iPhone og internett. Registrer deg for å synkronisere abonnement på flere enheter.

Lytt til 500+ tema