调查 Microsoft Intune 中的恶意脚本.pdf

1、Investigating a malicious script in Microsoft Intune:A DFIR case studySANS DFIR Summit 20252 2025 KPMG LLP,a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited,a private English company limit

2、ed by guarantee.All rights reserved.USCS026964-1AContents12345AgendaBaseline IntuneForensic analysisTools usedResearch6Summary3 2025 KPMG LLP,a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limi

3、ted,a private English company limited by guarantee.All rights reserved.USCS026964-1Awhoamiwhoami Dennis Labossiereexperience.ps1-job-degrees All-years-certs All Director within the KPMG Cyber Threat Management practice BS degree from Utica College(n/k/a Utica University)in cybercrime forensics and i

4、nvestigations MS degree from Utica College(n/k/a Utica University)in computer forensics and cyber operations Ten years of DFIR experience SANS GCFA SentinelOne Incident Response Engineer MITRE ATT&CK Defender CTI and Adversary Emulationcyber_passions.ps1-all Threat hunting and detection engineering

5、Ransomware investigationspersonal.ps1-all Husband and father Former collegiate baseball player Glamor camper(camping with electric hookup)who loves to fish and cook4 2025 KPMG LLP,a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms a

6、ffiliated with KPMG International Limited,a private English company limited by guarantee.All rights reserved.USCS026964-1AWIIFM?We all havesomething to learn(e.g.,defensive measures,new analytic technique,or a new data source).Reminder to leverage all available telemetry:Think about what data may be