Скачать или смотреть DFIR in 2022: The Wild Wild East - Jack Rutherford & Richard Grainger

Triskele Labs presents their DFIR experiences from 2022, which has included many ransomware and BEC incidents, often involving sophisticated Threat Actors such as Conti and Black Basta. We discuss trends, techniques, indicators, and deep dive into a particularly ruthless attack in which the Threat Actor achieved complete domain compromise, exfiltration and ransomware execution in just 14 hours.

Jack Rutherford is the CTO of Triskele Labs, an Australian cyber security boutique. Having spent 5 years at Triskele Labs and 10 years in cyber, he comes from an offensive security background, previously leading the penetration testing and red teams within Triskele Labs. Before that, he spent several years working in cyber security in government at both Defence and the ATO. Jack sits on the Australasian Advisory Board for CREST International and represents the Australasian chapter on the CREST International penetration testing subcommittee.

Richard Grainger has 15 years of experience working within technical IT roles, with the last 10 years being dedicated to law enforcement and industry in specialist digital forensic, incident response and cyber investigation. More recently, Richard has combined his deep skill-set in digital forensics, with skills required to respond quickly and effectively to real-time and ongoing incidents, in an incident response capacity. On a daily basis, Richard is helping organisations recover from devastating cyber attacks whilst preserving and collecting digital evidence to ensure the organisation is safe in the future. Richard is also responsible for assisting the Triskele Labs 24x7x365 SOC with ongoing investigations, Threat Hunting and driving continuous improvement.