Investigating a WSA Endpoint

This session will cover:
-Overview of unseen & new artifacts left/generated by WSA on a windows endpoint.
-Challenges from DFIR perspective about the usage of WSA.
-The proposed solution to the challenges.
-Tools and techniques used to analyze the artifacts of WSA (including Windows artifacts & hunting manually).
-WSA vs Android Device (similarities and dissimilarities).
-Can WSA be used for nefarious purposes or to gain persistence on a Windows endpoint?

SANS DFIR Summit 2023

Speakers:
Bhargav Rathod, Security Analyst, Salesforce …

amp android android device artifacts challenges device dfir endpoint generated hunting perspective session solution techniques tools windows windows artifacts wsa