Establishing Connections: Illuminating Remote Access Artifacts in Windows

SANS DFIR Summit 2022

Speaker: Fernando Tomlinson

All too often during an investigation, it comes to light that adversaries are leveraging existing remote access tools for initial access and lateral movement. This trend is continuously on the rise and tends to go unnoticed due to the lack of available logging or not understanding what the available logs provide. This talk will not only address the aforementioned but I also will be sharing custom tools that have proved to be beneficial …

access connections remote access windows