There’s Something About WMI - DFIR Summit 2015

by Devon Kerr, Senior Consultant, Mandiant, A FireEye Company

This presentation will describe the purpose and
components of Windows Management Instrumentation
(WMI) from the incident response and forensics
perspectives. Attendees will learn how targeted threats
are using WMI during each phase of the compromise, case
studies and examples, the artifacts generated by those
activities, some of the tools used to interact with WMI,
using WMI for persistent access that defeats antivirus and
application whitelisting, and the benefits of enabling WMI
trace logging for additional detection and improved analysis

Devon Kerr, Senior Consultant, Mandiant
Devon Kerr is a Principal Consultant at Mandiant, an enterprise
incident response(IR) and remediation lead, and has supported
investigations by providing host, network, and log analysis. Mr. Kerr developed and maintains Mandiant methodologies and documentation for the Compromise Assessment service, OpenIOC utilization, and hunting with the FireEye Threat Analytics Platform(TAP). @_devonkerr_

Видео There’s Something About WMI - DFIR Summit 2015 канала SANS Digital Forensics and Incident Response