Threat Hunting Using Live Box Forensics

In a threat landscape characterized by targeted attacks, fileless malware, and other advanced hacking techniques, the days of relying solely on traditional “dead box” forensics for investigations are… well, dead. Live forensics, a practice considered a dangerous and dark art just a decade ago, has now become the de facto standard. However, many Computer Security Incident Response Teams still struggle with this type of threat hunting.
John Moran will discuss the benefits and pitfalls of and best practices for performing live box forensics as a threat hunting tool. He will introduce and demo a free and publicly available command-line tool for Windows that automates the execution and data acquisition from other live forensics tools in a more secure and easier-to-maintain manner: