DFIR - Fix The Exchange! https://www.fixtheexchange.com Official Blog of Josh M. Bryant Fri, 05 Dec 2025 15:51:45 +0000 en-US hourly 1 https://wordpress.org/?v=6.9 Join me at the 2017 SANS Threat Hunting and Incident Response Summit – April 18th and 19th https://www.fixtheexchange.com/2016/12/13/join-me-at-the-2017-sans-threat-hunting-and-incident-response-summit-april-18th-and-19th/?utm_source=rss&utm_medium=rss&utm_campaign=join-me-at-the-2017-sans-threat-hunting-and-incident-response-summit-april-18th-and-19th&utm_source=rss&utm_medium=rss&utm_campaign=join-me-at-the-2017-sans-threat-hunting-and-incident-response-summit-april-18th-and-19th Tue, 13 Dec 2016 11:13:14 +0000 http://www.fixtheexchange.com/join-me-at-the-2017-sans-threat-hunting-and-incident-response-summit-april-18th-and-19th/ I’ll be presenting a brand new session titled “Hunting Webshells on Microsoft Exchange Server” at the 2017 SANS Threat Hunting and Incident Response Summit in New Orleans on April 18th and 19th! My session abstract:“Microsoft Exchange Servers are a high value target, making investigation of them during Incident Response vital, but where do you start? […]

The post Join me at the 2017 SANS Threat Hunting and Incident Response Summit – April 18th and 19th first appeared on Fix The Exchange!.

]]> I’ll be presenting a brand new session titled “Hunting Webshells on Microsoft Exchange Server” at the 2017 SANS Threat Hunting and Incident Response Summit in New Orleans on April 18th and 19th!

My session abstract:
“Microsoft Exchange Servers are a high value target, making investigation of them during Incident Response vital, but where do you start? What should you look for? Backdoor implants in the form of webshells hiding in OWA are on the rise. Find out how to hunt webshells and differentiate between legitimate use and attacker activity, using default logging available on every Exchange Server, through real world examples. It’s easier than you might think, and these techniques can help up your DFIR game in environments containing Exchange Servers!”

Full agenda: https://www.sans.org/event-downloads/45247/agenda.pdf

More details: https://www.sans.org/event/threat-hunting-and-incident-response-summit-2017

If you can’t make the summit, a recording should be available afterwards.  I’ll post a link to the recording and a detailed blog on this subject when available.

The post Join me at the 2017 SANS Threat Hunting and Incident Response Summit – April 18th and 19th first appeared on Fix The Exchange!.

]]>