Together, through hands-on labs and demonstrations, we’ll walk through gathering artifacts from Linux and Mac endpoints using Velociraptor Offline Collectors, CatScale, and UAC (Unix-like artifact collector) scripts, rapidly searching and analyzing artifacts, and identifying indicators of compromise!
You’ve received a “true positive” security alert for a Linux or Mac endpoint. This is not a drill! This is war and you need to take rapid, decisive steps to determine:
Has the endpoint been compromised?
Have other systems been impacted?
What actions should come next?
Together, through hands-on labs and demonstrations, we’ll walk through gathering artifacts from Linux and Mac endpoints using Velociraptor Offline Collectors, CatScale, and UAC (Unix-like artifact collector) scripts, rapidly searching and analyzing artifacts, and identifying indicators of compromise!
All labs will be completed through cloud VM via web browser.
You will need to register via SkillBit (MetaCTF), to pay a small fee for Virtual Machine resource utilization (approx. $5 for a four-hour workshop), and a modern web browser to access the workshop Cloud VM.
Patterson Cake has worked in cybersecurity for more than two decades, specializing in the development of incident-response teams, programs, and processes. He is currently the Director of Incident Response for Black Hills Information Security, holds more than twenty-five industry certifications, is a former SANS instructor, teaches for Antisyphon, and has trained law enforcement, military, and national cybersecurity organizations on four continents. Patterson is the creator of the “Incident Response Capabilities Matrix Model,” developed “Rapid Triage Workflow” for IR investigations, is a prolific speaker, and is actively involved in the cybersecurity community.
Register for Upcoming
Filter by Product Date
Filter by Product Instructor
Filter by Product Type
Workshop: Rapid Endpoint Investigations for Linux and Mac