Gaining 20/20 vision during an incident with PowerShell
Channel: PowerShell.org
Date: 2021-12-30

Presented by Fernando Tomlinson
Incidents happen and most depend on commercial tools but they may not always be available. Luckily, we are not out of luck as PowerShell can and is being used for incident response. We will demo how the language can aid you in your next incident including a few frameworks that I developed.

---

There will come a point where every organization will likely be compromised. To be able to identify it before or as it is happening, most acquire technology to help identify any malicious behavior but that technology comes with a price tag that not every organization can afford. With most organizations having Windows systems as the majority, there are other built-in options. This talk revolves around the use of PowerShell and supporting aspects as a suitable option for an incident response solution for endpoints in your environment, to include shortfalls of the language.