Old Dog, New Tricks - Forensics With PowerShell

Explore advanced digital forensics techniques using PowerShell in this comprehensive conference talk presented by Jared Atkinson at the 44CON Information Security Conference. Delve into the world of live box forensics and containment as Atkinson introduces PowerForensics, an all-in-one toolset designed for attack response and investigation. Learn how to leverage PowerShell's access to the Windows API and .NET framework to conduct forensically sound "live" investigations without imaging hard drives. Discover the project's background, capabilities, and its potential to revolutionize the Digital Forensics/Incident Response community's approach to tackling live threats. Gain insights into investigating advanced actors at scale and witness a complex demonstration showcasing PowerForensics' effectiveness in real-world attack scenarios. Understand the shifting landscape of cybersecurity threats and equip yourself with the knowledge to utilize PowerShell for defensive purposes, challenging the notion that it's solely a tool for red teams.