Beyond Strings – Memory Analysis during Incident Response

Presented at DerbyCon 2.0 Reunion (2012), Sept. 29, 2012, 2:30 p.m. (30 minutes)

During the incident response process, memory can be one of the sexiest places to look for information. We will identify specific structures and their data members that can help further an investigation and see how that fits into the bigger picture. We will also look at how and why those structures are created, whether it is a function of the operating system or the by-product of malware.

Presenters:

• J. Brett Cunningham / jbc22   as J. Brett Cunningham (jbc22)
  Brett Cunningham has primarily worked as a network defender and incident responser. He is active in the community, often providing support for Snorby and Sguil users.

Similar Presentations:

• BSidesLV 2016 / Don't Repeat Yourself: Automating Malware Incident Response for Fun and Profit
• GrrCON 2013 / Cloud Incident Response
• Black Hat USA 2016 / Building a Product Security Incident Response Team: Learnings from the Hivemind