This week we continue with the Windows fast triage series and talk about lateral movement evidence that may be found in logon event records.

This week Brian Carrier of Basis Technology joins me to talk about OSDFCon. The DFIR community relies on open source tools and the conference is a great way to get exposure to new tools and to learn how to use them. There's a great lineup this year with something for everyone. Registration is free for everyone.

This week is a case study where we look at an actual attack strategy and compared it against standard triage methods to see how well they hold up. In this episode I break down some attack methods attributed to APT32, also known as Ocean Lotus, and we’ll see how standard triage techniques hold up against the attack chain. 

Amanda Berlin of Blumira speaks on malicious Powershell attacks and defense techniques.

This week SUMURI's Steve Whalen (a.k.a. 'MacBoy') talks Mac forensics.