The Gist Of Hundreds Of Incident Response Cases

The speaker, who leads an incident response team in Switzerland, starts from a common problem: a customer reports a compromise across thousands of endpoints and the responder has to know where to begin. His answer is visibility first. Forensic agents are rolled out across the environment so data can be collected everywhere, because attackers often leave several backdoors on different systems, including remote monitoring tools, legitimate PowerShell scripts that call back to servers, and frameworks such as Cobalt Strike.

The middle of the talk covers the artifacts that tend to reveal attacker activity fastest. Antivirus logs, PowerShell logs, service creation events and autorun entries can expose footholds, and stacking service names to find values that appear only once across the network helps surface outliers. Executables in user-writable or public folders are another quick check. Collected data can be pushed into a SIEM with dashboards, and network connections can be enriched with public threat feeds to flag known command-and-control infrastructure. VPN and DHCP hostnames that break the company's naming convention can point to attacker machines. Less common sources, including the RDP bitmap cache, Task Manager usage history and Defender MPLog files, are shown as ways to deepen an investigation.

The closing section turns to process and people. Responders should delegate, ask for help when overloaded, trace the intrusion back to its initial entry point, and watch for burnout on the team. The main takeaway is to pair technical depth with project and people management, use tools such as Hayabusa and Velociraptor to find first hits, and then run a deep dive on each compromised host.