Invoke-IR / Presentations

2016 Presentations:

• SANS DFIR Summit (Austin, TX)
  • Start-Process -Name PowerShell | Get-ForensicArtifact [Abstract | Slides]
• PowerShell Conference Europe (Hannover, Germany)
  • Start-Process -Name PowerShell | Get-ForensicArtifact [Abstract | Slides | Video]
  • Creating an Agent-less IDS using WMI and PowerShell [Abstract | Slides]
• PowerShell & DevOps Global Summit (Bellevue, WA)
  • Old Dog, New Tricks: Forensics with PowerShell [Abstract | Slides | Video]
  • Creating an Agent-less IDS using WMI and PowerShell [Abstract | Slides | Video]
• NYC IT Pro Con (New York, NY)
  • [Abstract | Slides]

2015 Presentations:

• B-Sides DC (Washington DC)
  • **** It, Do it Live (PowerShell Digital Forensics) [Abstract | Slides | Video]
• 44CON London (London, England)
  • Old Dog, New Tricks: Forensics with PowerShell [Abstract | Slides | Video]

2014 Presentations:

• SANS DFIRCON (Monterey, CA)
  • A 10 Second Journey: Parsing the structure of the Windows 8 Prefetch Artifact [Abstract | Slides]