What Event Logs Part 2 Lateral Movement without Event Logs

Video Description

Working without Windows Event Logs - a two-part webcast series. Many analysts rely on Windows Event Logs to help gain context of attacker activity on a system, with log entries serving as the correlative glue between additional artifacts, But what happens when the attackers find ways to remove the logs, or worse, stop the logs from writing? We must find a way to adapt. In part 2 of this series, SANS instructor and incident responder Matt Bromiley will discuss techniques to identify lateral movement when Windows Event Logs are not present. Sometimes logs roll without preservation, and sometimes attackers remove them from infected systems. Despite this, there are still multiple artifacts we can rely on to identify where our attackers came from, and where they went. In this webcast, we'll discuss the techniques and artifacts to identify this activity. Watch Part 1 of the webcast series here: https://www.youtube.com/watch?v=7JIftAw8wQY&t=174s Event Logs is just one of the subjects covered in FOR508: Advanced Digital Forensics, Incident Response & Threat Hunting. For more information about the course visit: https://www.sans.org/FOR508 Speaker Bio Matt Bromiley, is a SANS Digital Forensics and Incident Response instructor and a GIAC Advisory Board member. He is also a senior managing consultant at a major incident response and forensic analysis company, bringing together experience in digital forensics, incident response/triage and log analytics. His skills include disk, database, memory and network forensics, as well as network security monitoring. Matt has worked with clients of all types and sizes, from multinational conglomerates to small, regional shops. He is passionate about learning, teaching and working on open source tools.