Effective DFIR Triage Techniques to Detect Modern Rootkits
Channel: BSidesDFW
Date: 2022-11-29

BSidesDFW 2022 Track 2 Session 7 - 05 Nov 2022

Effective DFIR Triage Techniques to Detect Modern Rootkits

The wealth of data available to incident response handlers during breach investigations is often overwhelming to both junior and senior analysts alike. Depending on the IT maturity of the victim organization, this data can range from days to months of forensic data acquired from hard drives, volatile memory (RAM), network sensors, AV/EDR engines, SIEMS, and beyond. Effectively and efficiently locating signs of malware and intrusions in such a large data set requires an analyst to possess techniques that lead to quick wins and avoid falling into rabbit holes. In this presentation, a walkthrough of effective DFIR techniques will be showcased against Windows rootkits that have been discovered in the wild. Through a combination of targeted file system and memory analysis, attendees will see precisely where the most actionable artifacts reside and how to detect such malware in an automated fashion. They will then be able to apply these techniques in the field to detect threats throughout environments they protect.

@attrc
Andrew Case is a senior incident response handler and malware analyst.
He has conducted numerous large-scale investigations that span enterprises and industries.
He is a core developer on the Volatility memory analysis framework, and a co-author "The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory".
www.dfir.org