Live forensic analysis and threat hunting

Digital forensic investigators operate on the principle that malware must always run on memory; there is nowhere they can hide. However, in recent times, technology has evolved to make memory massive and less volatile, giving rise to fileless malware – that is, malware that does not touch the disk – which maintains this hidden nature until execution time. The following sections will cover some of the tools that modern corporate investigators utilize to identify malware and conduct threat hunting, helping you understand common persistence mechanisms that malware uses.

EDR-based threat hunting

Advancements in computational technologies, cloud infrastructure, and support for massive disk and memory sizes have made it necessary for a new set of tools that can continuously monitor a host and collect live telemetry data on disk and memory, capture every footprint of an application, spot malware, and stop the attack before it can...