Explore the capabilities of GRR, an open-source remote live-forensics system developed by Google, in this informative Black Hat conference talk. Discover how GRR enables rapid incident response and large-scale threat hunting across an entire fleet of machines. Learn about common use cases, including collecting persistence mechanisms, analyzing network connections, examining process listings, and investigating browsing history. Understand the power of GRR's artifact collection feature and its ability to perform binary collection for malware analysis. Gain insights into the challenges of implementing GRR across different environments and the future directions of the project, including integration with other open-source forensics tools and IOCs. This 58-minute presentation by Greg Caste provides valuable knowledge for cybersecurity professionals looking to enhance their incident response and threat hunting capabilities.
Overview
Syllabus
GRR: Find All the Badness, Collect All the Things
Taught by
Black Hat
Related Courses
-
Dear Blue Team - Proactive Steps to Supercharge Your IR
-
Google Workspace Forensics - Insights from Real-World Hunts and Incident Response
-
Begin Your Journey into DFIR, Blue Team, Malware and Threat Hunting
-
Starting with Velociraptor Incident Response
-
Cyber Threat Hunting and DFIR - Understanding Malware Attack Steps
-
IOCaware - Actively Collect Compromise Indicators and Test Your Entire Enterprise
