Anti-Cast: Is That Toaster on Your Threat Model? with Nathan Sweaney and Kathy Collins
2023-05-31 12:00 - 13:00 (America/New_York)
Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Anti-Cast: Linux Command Line Dojo - You Can Teach an Old Dog New Tricks with Hal Pomeranz
2023-06-21 12:00 - 13:00
If you’ve been using the Linux command line for a long time, you may have missed out on some sweet new features of common commands that can make your life much better. Join Sensei Hal as we break down some practical examples and demonstrate some useful new functionality.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Linux Command Line Dojo – You Can Teach an Old Dog New TricksDownload the slides here!

Anti-Cast: Strengthening Your Blue Teaming Skills - Thinking Like an Attacker with Markus Schober
2023-06-28 12:00 - 13:00
This webcast will explore the vast amount of challenges faced by blue teamers and how they can stay ahead of the curve. Through a ransomware attack example, we’ll discuss the broad range of skills and knowledge needed to respond effectively to advanced threats. We’ll elaborate on how thinking like an attacker and employing a purple teaming approach for skills development has proven to be the best defense for many blue teamers. The session will conclude with a Q&A portion to provide answers on what and how blue teamers need to upskill.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Strengthening Your Blue Teaming Skills Thinking Like an AttackerDownload the slides here!

Anti-Cast: Forensicating Linux LD_PRELOAD Rootkits with Hal Pomeranz
2023-07-12 12:00 - 13:00
Widespread availability of PoC Linux LD_PRELOAD rootkits means that even trivial cryptomining attacks are starting to deploy them. This talk demonstrates a simple LD_PRELOAD rootkit and techniques for detecting them in a live response scenario and by memory analysis. Get the jump on your adversaries with this fast-paced, practical introduction.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Forensicating Linux LD_PRELOAD Rootkits with Hal PomeranzDownload the slides here!

Anti-Cast: The Symon Update is Here with Gerard Johansen
2023-07-19 12:00 - 13:00
The long-awaited update to Sysmon is here. Microsoft has recently released version 15. This updated version of the popular logging tool includes new features and provides responders insight into endpoint behavior. In this Anti-Cast, Gerard Johansen, digital forensics practitioner and course author of Enterprise Forensics and Response will walk through how Sysmon can aid in incident investigations. Gerard will provide an overview of Sysmon, including what data analysts can see, how to deploy and configure and finally looking at how Sysmon can aid in incident investigations. How configurations can be tailored. Local and remote acquisition of Sysmon log files and finally how to analyze various Tactics and Techniques commonly seen in incident investigations.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

The Sysmon Update is Here with Gerard JohansenDownload the slides here!

Anti-Cast: OSINT Uncovered - Unlocking the Hidden Gems of Online Information with Mishaal Khan
2023-07-26 12:00 - 13:00
This Anti-Cast session explores advanced techniques and tools for extracting valuable information from diverse online platforms, social media, public databases, and breaches. By emphasizing responsible approaches to OSINT, attendees will learn how to navigate vast data sources, analyze digital footprints, and uncover the hidden gems of online information. Learn to harness the power of OSINT, as Mishaal walks you through some quick OSINT demos. Stalkers not allowed!

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

OSINT Uncovered with Mishaal KhanDownload the slides here!

Anti-Cast: Obtaining NETNLM Hashes by Asking Nicely with Qasim Ijaz and Jake Nelson
2023-08-02 12:00 - 13:00
Active Directory loves spewing hashes, all kinds of them. This talk will focus on NetNTLM (or NTLM, call it what you will) hashes. We’ll chat about how they can be obtained and used for privilege escalation and lateral movement. Here’s what we’ll cover:

What NetNTLM hashes are and how they fit into AD

Different ways to get NetNTLM hashes

Broadcast and multicast-based name resolution protocols

Coercion and elicitation (PetitPotam, DFSCoerce, shortcut files/ icons, and even Microsoft Word)

How to crack and relay NetNTLM hashes

How to defend yourself against these types of attacks

We’ll break down each topic and will demonstrate some tools and techniques you can use to get and utilize NetNTLM hashes.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Obtaining NetNTLM Hashes by Asking NicelyDownload the slides here!

Anti-Cast: Down with the CISO with Nathan Case
2023-08-09 12:00 - 13:00

Anti-Cast: XFS Forensics with xfs_db with Hal Pomeranz
2023-08-16 12:00 - 13:00
Despite being a common Linux file system, forensic support for XFS is still largely lacking. In this session, Hal will describe how to turn the humble xfs_db tool into a useful forensic application for examining XFS file system internals and finding critical evidence. Attackers aren’t the only ones who can “live off the land”!

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

XFS Forensics with xfs_db with Hal PomeranzDownload the slides here!

Anti-Cast: Exploring PowerShell Logging with TellTail with Carrie Roberts
2023-08-30 12:00 - 13:00
TellTail is a free and open source application that makes it easy to view and learn about PowerShell logging. In this webcast we will enable/disable the various PowerShell logging options and watch the effect it has on what gets logged. Come to this webcast to learn more about PowerShell Script Block and Module logging and how you can easily explore and learn on your own.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Exploring PowerShell Logging with TellTailDownload the slides here!

Anti-Cast: The Wrong Beer to the Barbecue - BYOVD Attacks with Alissa Torres
2023-09-06 12:00 - 13:00
Based on recent threat reports, a growing number of bad actors are bringing vulnerable drivers to victim environments to exploit and guarantee a more successful attack path. These kernel drivers are legitimate, trusted and… vulnerable! Amazingly, some have CVEs dating back to 2015 or earlier. During this Anti-Cast, we will map out detection methods to identify and remove vulnerable drivers already present in your network AND devise prevent/block strategies to future-proof against BYOVD attacks.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

The Wrong Beer to the Barbecue with Alissa TorresDownload the slides here!

Anti-Cast: Credential Compartmentalization in Active Directory with Eric Kuehn
2023-09-13 12:00 - 13:00
When it comes to security, the goal is to make an attacker’s job as difficult as possible. The more hurdles they must jump through, the easier it should be to detect and stop them. Unfortunately, common practices around how and where privileged accounts are used in Windows environments reduces the race down to only a couple of jumps (or maybe just a sprint). We will talk about why device and account tiering is critically important for making a network a virtual obstacle course.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Credential Compartmentalization in Active Directory with Eric KuehnDownload the slides here!

Anti-Cast: API-ocalypse Now with Jennifer Shannon
2023-09-20 12:00 - 13:00
Get ready for a wild ride as Jennifer Shannon, a Senior Security Consultant at Secure Ideas, presents “API-ocalypse Now.” In this thrilling and entertaining webcast, Jennifer will showcase the vulnerabilities lurking within APIs and the havoc they can wreak if left unaddressed. Through live pentesting demos, she will demonstrate jaw-dropping exploits, mind-bending injection attacks, and authentication bypass techniques that will leave you on the edge of your seat. Join Jennifer as she navigates the dark side of APIs to help you understand and fortify your attack surface in order to prevent the impending API-ocalypse.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

API-ocalypse Now with Jennifer ShannonDownload the slides here!

Anti-Cast: Infiltrating Kubernetes - Attacker Motives and Methods with Cory Sabol
2023-09-27 12:00 - 13:00
In this one-hour webinar, we will explore an overview of the threats targeting Kubernetes, a crucial technology for managing containerized applications. “Infiltrating Kubernetes: An Overview of Attacker Motives and Methods,” aims to equip IT professionals, DevOps engineers, and cybersecurity enthusiasts with insights into why and how attackers infiltrate Kubernetes environments.We will briefly introduce Kubernetes principles, then move to analyze the motivations behind its attacks, spotlighting the various attack vectors and potential vulnerabilities within Kubernetes clusters. Participants will learn about advanced threats, including exploitation of misconfigurations, privilege abuses, and container escape techniques.

Finally, we will cap the session off with a live demo of an advanced container escape technique!

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Infiltrating Kubernetes- Attacker Motives and MethodsDownload the slides here!

Anti-Cast: Applying WWII-Era Analytic Techniques to CTI with Jake Williams
2023-10-04 12:00 - 13:00
Everything old is new again, including intelligence analytic techniques. In today’s webcast, Jake will introduce you to Kent’s Analytic Doctrine, a formal intelligence analysis doctrine developed and refined in WWII. You don’t need to be a CTI analyst to benefit from this webcast. Practically every job in cybersecurity requires some level of analysis and understanding analytic models will make you better. We’ll even walk through some case studies from WWII showing how this timeless doctrine works for challenges both in and out of cyber. Then we’ll discuss how you can use these explicitly in cyber threat intelligence to provide better rigor in your cyber analysis.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Applying WWII-Era Analytic Techniques to CTIDownload the slides here!

Anti-Cast: Tales of AV/EDR Bypass - Double Feature with Greg Hatcher and John Stigerwalt
2023-10-11 12:00 - 13:00
First Showing:Delve into the realm of compiler tactics to navigate AV and EDR safeguards. Discover the potential of Cobalt Strike payloads to sidestep these security measures. Explore compilers like Clang++, LLVM, and G++, showcasing their role in reshaping security strategies.

By showcasing submissions aimed at diverse vendors, underscore the simplicity with which this shift can reintroduce invisibility to payloads. You’ll get sample code, enabling you to explore these strategies on your own.

Second Showing:Shellcode loaders evolution has been interesting, however, some AV/EDR products have begun detecting the usage of direct and indirect syscalls in malware.

But what if we didn’t hard-code syscalls or even jump to a syscall region? This presentation is a deep dive into using a specific set of Windows callbacks working within their own thread pools.

Attendees should expect to learn how to call Windows APIs using ROP gadgets, basics of ROP, and why current detection mechanisms won’t work against this attack. This is the next evolution of calling Windows APIs in malware.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Anti-Cast: Horrors of Cybersecurity - Tabletops, Playbooks, & Bots! with Amanda Berlin and Jeremy Mio
2023-10-25 12:00 - 13:00
This frightful webcast introduces ghoulish training exercises, creepy incident response playbooks, and spine-chilling after-action reports to help you prepare for a hair-raising cyberattack.

Terror Tabletops (TTXs): Planning scary cybersecurity scenarios to test your defenses against the forces of darkness

Macabre Playbooks: Developing creepy incident response plans to stop cyber monsters in their tracks

Haunted Gamification: Making your exercise fun yet frightening with interactive elements to engage your team

Game Bot Overview & Mini Haunting: A quick look at using chatbots to automate your horror-themed exercises

Get ready for a thrilling webcast that will help you confront your deepest cybersecurity fears! Let’s start planning a terrifyingly effective cyber exercise for this Halloween season.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Horrors of Cybersecurity – Tabletops, Playbooks, & Bots with Amanda and JeremyDownload the slides here!

Anti-Cast: Next Hands-On IR D&D Style Webcast with John Strand and Douglas Brush
2023-11-01 12:00 - 13:00
In our last incident response webcast, we may have been responsible for bringing down GitHub. I have been told that it is just not possible. You can see the recording of that webcast here: https://youtube.com/live/n8aE5bwPLog Judge for yourself….

In this next webcast, we will have backups. You know, just in case. For this webcast, we will have a panel of surprise guests pretending to be characters for a D&D style IR story. But, the catch is you will all do the hands-on work with actual evidence of an actual attack. (That we simulated in a lab.) Sorry, not doing this with real IR data. Not today, Satan. Not today. As always with these IR scenarios, full logfiles and a walkthrough will be provided after the event.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Anti-Cast: Go St*lk Yourself - Privacy Through OSINT with Mishaal Khan
2023-11-08 12:00 - 13:00
It’s always scary to Google yourself and see what you find.

In this session, we dive into the eerie reality of personal information exposure on the internet. We’ll look at some of the resources stalkers use to get information on their victims. The combination of home address, phone number, email, social media profiles, and even family relatives can be a gold mine for stalkers. Don’t miss this opportunity to strengthen your online privacy from the lens of an OSINT expert. You’ll learn the best strategies to get your personal information out of the internet and escape the perils of stalking, doxing, swatting, or account hijacking. Your digital safety is at stake – let’s be prepared!

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Anti-Cast: Enterprise DFIR Investigation Scenario with Markus Schober
2023-11-15 12:00 - 13:00
Based on a compromised employee workstation scenario, we’ll discuss how to conduct an effective DFIR investigation within enterprise environments, following the incident response lifecycle. We’ll discuss triage and containment considerations, as well as elaborate on best practices for performing effective data collections and forensic analysis. To wrap up, we will discuss critical remediations and post-incident activities that should be taken into account.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Enterprise DFIR Investigation Scenario with Markus SchoberDownload the slides here!

Anti-Cast: How to Write an Adduser Shellcode with Marco Lux
2023-11-22 12:00 - 13:00
This Anti-Cast jumps right into writing a linux 32Bit shellcode, for adding a new uid 0 user to the system passwd file.

With 20 years of experience in the field, Marco has developed a strong interest in computer security, hacking, and penetration testing.

Throughout his career, he has specialized in breaking network

infrastructures and web applications. He has also gained hardware knowledge and red teaming experience.

What sets Marco apart is his fascination with network protocol analysis and low-level computing. Throughout his journey, Marco authored tools related to security vulnerabilities and uncovered several critical issues.

As a speaker and trainer at security events, he shared his knowledge and insights on a variety of security subjects.

Outside of cybersecurity, Marco takes pleasure in cycling and exploring the great outdoors.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

How to Write an Adduser ShellcodeDownload the slides here!

Shellcode – Adduser LabDownload the lab instructions here!

Anti-Cast: Oil, Circuits, & Cheese - An Additive Model of Failure with Jennifer Shannon
2023-11-29 12:00 - 13:00
The Swiss cheese model, developed in 1990 by James Reason, is based on the idea that errors can never be eliminated entirely due to complex systems but are instead “layered” like slices of swiss cheese. This model has become a well-known concept in the field of risk management that highlights how multiple layers of defense can fail, leading to a catastrophic outcome. This model aims to provide information to decision-makers to help them reduce the chances of incidents occurring. It is crucial to keep in mind that all safety measures within an organization are linked, and by implementing appropriate policies and standards, risk can be minimized. So how can we apply this model to cybersecurity, where multiple layers of security can be breached during a compromise? This talk will explore how the Swiss cheese model can be used to understand the vulnerabilities and cybersecurity risks posed to organizations. We will also examine how the layers of defense, including people, processes, and technology, can fail and lead to a breach.

Jennifer is a senior security consultant at Secure Ideas with a background in malware analysis, penetration testing, and teaching. An avid computer geek for most of her life, she began her journey in cybersecurity as a SOC Analyst, where she showed an aptitude for penetration testing and malware analysis. Her background as “blue team” uniquely prepared her for guiding clients through remediation and contextualizing findings for their environment.

She graduated with honors from Florida State College at Jacksonville’s networking program. While pursuing her degree, she dedicated time to teaching computing skills to underrepresented minorities. Jennifer continues to be passionate about teaching and is eager to share her knowledge with anyone who will listen.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Oil, Circuits, and CheeseDownload the slides here!

Anti-Cast: Triad of Success - Education, Experience, and Networking with Wade Wells
2023-12-13 12:00 - 13:00
In the ever-evolving landscape of professional development, the triad of education, experience, and networking emerges as a foundational pillar for career growth and success.

This free one-hour Antisyphon Anti-Cast delves into the intricate interplay of these three crucial elements, exploring how they individually and collectively influence career trajectories.

Wade aims to equip the audience with a comprehensive understanding of how education, experience, and networking function as key drivers in shaping a successful career.

Attendees will leave with actionable insights and strategies to apply these principles in their own professional journeys.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Triad of Success – Education Experience and Networking with Wade WellsDownload the slides here!

Anti-Cast: Sharpening Your Skills - Web PenTesting with SamuraiWTF with Kevin Johnson
2023-12-20 12:00 - 13:00
Join us for an in-depth exploration in ‘Sharpening Your Skills: Web PenTesting with SamuraiWTF,’ where we dive into the techniques and tools for web application security.

This talk is specially designed for those eager to elevate their web penetration testing skills using the OWASP Samurai Web Training Framework (SamuraiWTF). We will not just discuss but actively demonstrate the tools and targets within SamuraiWTF. The session is structured to provide a practical, demo-heavy approach, allowing attendees to see the tools and techniques in action.

Whether you’re looking to refine your existing skills or explore new strategies in web security, this session promises to be an engaging and deeply informative journey into the world of web penetration testing.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Anti-Cast: New Year, New Skills: Web App Pentesting with Jennifer Shannon
2024-01-10 12:00 - 13:00
In a world where web applications are the new battleground.

Hackers are constantly looking for ways to exploit them and steal your secrets, sabotage your network, or harm your customers.

But you are not alone…

Jennifer Shannon is here to help you fight back.

In this free one-hour Antisyphon Anti-cast, Jennifer will teach you how to test your web applications and find the vulnerabilities before they do.

She will show you the tools, the techniques, and the tricks of the trade.

This is not just a Anti-cast… This is a mission.

Are you ready to join?

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

2024_01_10_anticast_New Year, New Skills_Web App Pentesting_Jennifer ShannonDownload the slides here!

Anti-Cast: WMI Abuse: How Threat Actors Use WMI with Gerard Johansen
2024-01-17 12:00 - 13:00
In this free one-hour Antisyphon Anti-Cast, Gerard Johansen, Principal Readiness Engineer for Red Canary and Antisyphon instructor, will run through how threat actors use the Windows Management Instrumentation (WMI) for Lateral Movement and Persistence.

Gerard will walk through how threat actors use WMI, what trace evidence is left and how to analyze WMI abuse.

Finally, Gerard will walk through some demonstrations using Atomic Red Team and forensic tools.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

2024_01_17_anticast_WMI Abuse-How Threat Actors Use WMI_Gerard JohansenDownload the slides here!

Anti-Cast: Cloud Identity Management for Everyone with Andrew Krug
2024-01-24 12:00 - 13:00
In every cloud, Identity and Access Management are incredibly challenging for the most skilled practitioners.

In this free one-hour Antisyphon Anti-Cast we’ll review different cloud provider identity and access paradigms, look at the systems for granting access, and where the pitfalls are.

We’ll review the various grammars as well and demystify IAM for any user of any cloud.

Attendees will leave with a firm understanding of how to go beyond the defaults.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

Anti-Cast: Active Directory Hacking-3 'New' Techniques with Eric Kuehn
2024-01-31 12:00 - 13:00
If you want to master the art of penetration testing, you need to know how to exploit Active Directory (AD).

It’s the backbone of most networks and it holds the keys to the kingdom. But cracking it is not always easy.

You need to use the right tools and techniques for the job.

In this free one-hour Antisyphon Anti-Cast, you’ll learn 3 different ways that can help you extract valuable information from AD, modify its settings and gain full control over the network.

This Anti-Cast comes with practical demos and tips that will boost your hacking skills.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

2024_01_31_anticast_Active Directory Hacking-3 ‘New’ Techniques_Eric KuehnDownload the slides here!

Anti-Cast: All About Systemd Timers with Hal Pomeranz
2024-02-07 12:00 - 13:00
The Linux-guru, Hal Pomeranz, returns for a free one-hour Antisypon Anti-cast!

As if Linux didn’t already have enough task scheduling mechanisms, we now have “timers”—a highly configurable task scheduling mechanism implemented by Systemd. Threat actors are already starting to use Systemd timers for persistence.

Hal will cover the basics of configuring Systemd timers and how they operate, plus forensic indicators you can look for to find any timers deployed in your systems.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

2024_02_07_anticast_All About Systemd Timers_Hal PomeranzDownload the slides here!

Anti-Cast: For the Love of the Windows Search Index with Alissa Torres
2024-02-14 12:00 - 13:00
The Windows Search Indexer service does not just provide a fast way to locate and access a misplaced file, this service’s database holds tremendous forensic value for host investigations.

With the recent introduction of efficient parsing tools, analysts can gain access to these gems from the Indexer database: directory/file metadata, content file summaries and user browser/activity logs.

Join Alissa Torres in this free one-hour Antisyphon Anti-Cast to learn how the Windows Search Index can augment your investigations. Fall in love with this under-rated artifact.

Chat with your fellow attendees in the Antisyphon Discord server:https://discord.gg/antisyphonin the #🍿anticasts-chat channel

Stay up to date on our upcoming live Anti-Casts and more at https://poweredbybhis.com

2024_02_14_anticast_For the Love of the Windows Search Index_Alissa TorresDownload the slides here!
