Home
Talks
CFP Guide
What is BSides?
About
Contact
Light
← All talks
Topic
DFIR talks at BSides
237 talks tagged
DFIR
from 75 chapters of BSides events worldwide.
Related topics
Blue
Case Studies and Incidents Analysis
Technical
Talk
Intermediary
War Stories
49:41
Open Source Malware Lab
Robert Simmons
BSides London
· 2016
Technical
DFIR
Detection Engineering
Malware Analysis
Intermediary
Blue
Technical Deep-dives
Talk
Open →
2016-07
54:05
The Road to Hell is Paved with Bad Passwords
Chris Kubecka
BSides Las Vegas
· 2019
War Stories
DFIR
Threat Intel
Case Studies and Incidents Analysis
Talk
Open →
2019-10
27:37
PowerShell-Fu — Hunting on the Endpoint
Chris Gerritz
BSides Las Vegas
· 2016
Technical
DFIR
Malware Analysis
Threat Intel
Blue
Technical Deep-dives
Talk
Open →
2016-08
41:15
OSTrICa – Open Source Threat Intelligence Collector
Roberto Sponchioni
BSides London
· 2016
Technical
DFIR
Threat Intel
Tooling
Demo
Talk
Open →
2016-07
41:25
Command-Line Obfuscation: You Can Run, _and_ You Can Hide
Wietze Beukema
BSides Dublin
· 2024
Technical
DFIR
Detection Engineering
Talk
Open →
2024-06
2:08:11
Windows Forensics Workshop
Ali Hadi
BSides Amman
· 2021
Technical
DFIR
Intermediary
Workshop
Open →
2021-07
51:37
Security Onion: Peeling Back the Layers of Your Network in Minutes
Doug Burks
BSides Augusta
· 2013
Technical
Tooling
DFIR
Detection Engineering
Network Security
Blue
Demo
Talk
Open →
2013-09
1:05:41
Hunting for Credential Dumping Attacks in Modern Windows Environments
Andrew Case
BSides Philly
· 2023
Technical
Active Directory
DFIR
Malware Analysis
Blue
Talk
Open →
2024-01
44:35
Anti-forensics Techniques Used By Threat Actors In The Wild
Hela Lucas
BSides London
· 2024
Technical
DFIR
Malware Analysis
Blue
Case Studies and Incidents Analysis
Talk
Open →
2024-02
51:34
Let's Get Cooking with CyberChef
Marcelle Lee
BSides Charm
· 2022
Technical
DFIR
Malware Analysis
Threat Intel
Talk
Open →
2022-07
38:26
The Woman Who Squashed Terrorists When an Embassy Gets Hacked
Chris Kubeka
BSides Cape Town
· 2019
War Stories
DFIR
Threat Intel
Blue
Case Studies and Incidents Analysis
Keynote
Open →
2019-12
42:44
Threat Hunting On Linux And Mac With Auditbeat System Module
Aaron Jewitt
BSides Luxembourg
· 2019
Technical
DFIR
Detection Engineering
Blue
Talk
Open →
2019-11
29:48
Kevin Breen: RATs and IOC's - The Easy Way
Kevin Breen
BSides London
· 2014
Technical
DFIR
Malware Analysis
Threat Intel
Talk
Open →
2014-05
55:21
IoT 4n6: The Growing Impact of the Internet of Things on Digital Forensics
Jessica Hyde
BSidesROC
· 2018
Technical
DFIR
IoT
Talk
Open →
2018-08
56:31
Using JA3: Asking for a Friend?
Justin Warner
Ed Miles
BSides DC
· 2019
Technical
Cryptography
DFIR
Detection Engineering
Network Security
Blue
Red
Talk
Open →
2019-11
36:18
Macabre Stories of a Hacker in the Public Health Sector (Chile)
Philippe Delteil
BSides Cape Town
· 2019
War Stories
DFIR
Privacy
Vulnerability Research
Blue
Case Studies and Incidents Analysis
Talk
Open →
2019-12
24:45
Honeydocs and Offensive Countermeasures
Roy Firestein
BSides Toronto
· 2014
Technical
DFIR
Threat Intel
Blue
Demo
Talk
Open →
2014-12
45:56
Flash Memory, NAND, ECC, Oh My! Practical Techniques for Acquiring and Processing Raw NAND Images
Jake Valletta
BSides Charleston
· 2022
Technical
DFIR
Hardware Hacking
IoT
Reverse Engineering
Technical Deep-dives
Talk
Open →
2023-01
30:07
GSuite Digital Forensics and Incident Response
Megan Roddie
BSides SATX
· 2018
Technical
Cloud IAM
DFIR
Intermediary
Blue
Case Studies and Incidents Analysis
Talk
Open →
2018-07
46:36
Incident Management with PowerShell
Matt Johnson
BSides Detroit
· 2013
Technical
DFIR
Blue
Talk
Open →
2013-06
27:24
Cold Case — Catch a Killer in 16 Bytes
Iggy
BSides Canberra
· 2021
Technical
War Stories
DFIR
Hardware Hacking
Reverse Engineering
Advanced
Case Studies and Incidents Analysis
Technical Deep-dives
+1
Open →
2021-04
37:51
Building an Effective Intrusion Detection Program
Jason Craig
BSidesSF
· 2017
Technical
DFIR
Detection Engineering
Threat Intel
Blue
Talk
Open →
2017-03
31:32
Maersk: The Ransomware Survivors
Endrin Musa
BSides Prishtina
· 2017
Technical
DFIR
Malware Analysis
Supply Chain Security
Intermediary
Case Studies and Incidents Analysis
Talk
Open →
2023-05
22:40
Pensieve: Finding Malicious Artifacts in Container Environments
Yathi Naik
BSidesSF
· 2018
Technical
Container Security
DFIR
Malware Analysis
Intermediary
Blue
Technical Deep-dives
Talk
Open →
2018-04
33:40
Quick And Easy Forensic Timelines Via Sysmon, WEF, And ELK
Aaron Jewitt
BSides Munich
· 2019
Technical
DFIR
Detection Engineering
Blue
Talk
Open →
2019-03
28:47
Learning from AWS Customer Security Breaches
Rami McCarthy
Bsides CT
· 2020
Technical
Cloud IAM
DFIR
Intermediary
Case Studies and Incidents Analysis
Talk
Open →
2020-11
50:28
Estonian Electronic Identity Card and its Security Challenges
Arnis Paršovs
BSides Tallinn
· 2021
Research
Cryptography
DFIR
Advanced
Case Studies and Incidents Analysis
Technical Deep-dives
Talk
Open →
2021-10
47:19
The Dangers of Working in Cyber Security
Simon Whittaker
BSides Belfast
· 2017
War Stories
Career & Soft Skills
DFIR
Threat Intel
Case Studies and Incidents Analysis
Talk
Open →
2017-10
40:43
Digital Forensics: The Missing Piece of Internet of Things Promise
Ali Dehghantanha
BSides Manchester
· 2017
Research
DFIR
IoT
Talk
Open →
2017-08
20:25
Leveraging Osquery for DFIR at Scale
Sohini Mukherjee
BSidesSF
· 2020
Technical
DFIR
Detection Engineering
Intermediary
Talk
Open →
2020-03
29:14
Alex Kirk - Incident response and threat hunting using Bro/Zeek data
Alex Kirk
BSides Augusta
· 2019
Technical
DFIR
Detection Engineering
Threat Intel
Intermediary
Blue
Case Studies and Incidents Analysis
Technical Deep-dives
+1
Open →
2019-10
30:15
Incident Response Evidence Collection & Triage
John Meyers
BSides Peru
· 2017
Technical
DFIR
Malware Analysis
Blue
Demo
Talk
Open →
2017-06
26:00
Exposed Secrets — How Public Git Repositories and Docker Images Expose Millions of Secrets
Mackenzie Jackson
BSidesSF
· 2022
Research
DFIR
Supply Chain Security
Threat Intel
Case Studies and Incidents Analysis
Empirical Research
Talk
Open →
2022-07
41:24
BSides Perth Day 1 (Part 2)
BSides Perth
· 2021
Technical
DFIR
Detection Engineering
Malware Analysis
Intermediary
Blue
Technical Deep-dives
Talk
Open →
2021-09
51:56
Unbreaking the iPhone: Bootchain Reversal, SEP Sabotage, and the iOS Kernel Frontier
Jack Sessions
BSides Canberra
· 2025
Technical
DFIR
Mobile Security
Reverse Engineering
Advanced
Red
Technical Deep-dives
Demo
Open →
2025-11
45:13
Analyzing volatile memory on a Google Kubernetes Engine node
Marcus Hallberg
BSides NYC
· 2023
Technical
Cloud IAM
Container Security
DFIR
Demo
Talk
Open →
2023-06
37:47
Don't Google 'PowerShell Hunting'
Josh Rykowski
Sean Eyre
BSides Augusta
· 2017
Technical
DFIR
Detection Engineering
Malware Analysis
Talk
Open →
2017-09
8:26:49
Thinking Outside the SOC: Structured Analytical Techniques for the Overloaded Cyber Analyst
Haley Beam
Alina Thai
BSides Las Vegas
· 2025
Technical
DFIR
Detection Engineering
Threat Intel
Talk
Open →
2025-08
58:14
Velociraptor: Digging Deeper
Michael Cohen
BSides Sydney
· 2019
Technical
DFIR
Threat Intel
Blue
Demo
Talk
Open →
2019-09
27:24
From Buzzword to Battlefield: The Cybersecurity Challenges of Smart Cities
Marina Bochenkova
BSides Lisbon
· 2024
Policy
Technical
Critical Infrastructure
DFIR
IoT
Supply Chain Security
Intermediary
Blue
+2
Open →
2024-11
36:38
Forensics Impossible: Self-Destructing Thumb Drives
Brandon Wilson
BSides Knoxville
· 2016
Technical
DFIR
Hardware Hacking
Reverse Engineering
Advanced
Red
Talk
Open →
2016-06
38:25
Matriux Leandros: An Open Source Penetration Testing and Forensic Distribution
Prajwal Panchmahalkar
BSides Las Vegas
· 2013
Technical
DFIR
Tooling
Talk
Open →
2017-01
1:00:10
Threat Hunting In Practice - Michael-Angelo Zummo
Michael-Angelo Zummo
BSides KC
· 2022
Technical
DFIR
Threat Intel
Blue
Talk
Open →
2022-10
35:06
Fiddling with Flash Drive Forensics
Alexander Klepal
BSides SATX
· 2018
Technical
DFIR
Windows Registry Forensics
Intermediary
Red
Technical Deep-dives
Talk
Open →
2018-07
38:01
Living on the Edge: Evicting Threat Actors from Perimeter Appliances
Evgen Blohm
Marius Genheimer
BSides Frankfurt
· 2025
Technical
DFIR
Network Security
Vulnerability Research
Advanced
Blue
Case Studies and Incidents Analysis
Technical Deep-dives
+1
Open →
2025-12
44:37
Malware Analysis for the Masses
Shawn Thomas
BSides Charm
· 2022
Technical
DFIR
Malware Analysis
Intro
Blue
Demo
Talk
Open →
2022-07
43:12
Tracking Malicious Logon: Visualize and Analyze Active Directory Event Logs
Shusei Tomonaga
Tomoaki Tani
BSides Las Vegas
· 2018
Technical
Active Directory
DFIR
Threat Intel
Blue
Talk
Open →
2018-09
51:16
Rosetta 2: Keeping Mac Malware Alive for Years to Come
Raphaela Mettig
Charles Glass
BSides Dallas/Fort Worth
· 2022
Research
Technical
DFIR
Malware Analysis
Reverse Engineering
Advanced
Empirical Research
Technical Deep-dives
+1
Open →
2022-11
20:58
Modifying WhatsApp Messages
Yuri Livshitz
BSides TLV
· 2021
Technical
DFIR
Mobile Security
Technical Deep-dives
Demo
Open →
2021-08
32:39
Unpacking Impacket: Detect remote execution of offensive tools
Tyler Bohlmann
BSides SLC
· 2022
Technical
Active Directory
DFIR
Detection Engineering
Blue
Talk
Open →
2023-01
33:46
Is the Power Grid a Huge Cybersecurity Risk?
Vivek Ponnada
BSides Vancouver
· 2021
Technical
Critical Infrastructure
DFIR
Network Security
Talk
Open →
2021-06
27:32
Behind the Curtain of Dark Web and Cybercrime Operations
Alexander Wilczek
BSides Canberra
· 2025
Research
Technical
Cryptography
DFIR
Threat Intel
Talk
Open →
2025-12
59:08
Closed For Business: Taking Down Darknet Markets
John Shier
BSides Cymru Wales
· 2019
Technical
DFIR
OSINT
Threat Intel
Talk
Open →
2019-10
52:06
No Disassembly Required
Brian Satira
BSides Peru
· 2018
Technical
DFIR
Malware Analysis
Reverse Engineering
Blue
Talk
Open →
2018-06
18:48
Think You're Stealthy? How to Detect Attacks in AD
Rachit Arora
Sai Sathvik Ruppa
Aakash Raman
BSides Charm
· 2025
Technical
Active Directory
DFIR
Detection Engineering
Intermediary
Blue
Talk
Open →
2025-05
29:00
Unraveling the Russian Snake: Turla
BSides Dallas/Fort Worth
· 2022
Technical
DFIR
Malware Analysis
Threat Intel
Intermediary
Blue
Case Studies and Incidents Analysis
Technical Deep-dives
+1
Open →
2022-11
39:38
10 Things I Wish Every CISO Knew Before an Incident: A View from the IR Trenches
Patterson Cake
BSides Knoxville
· 2023
Technical
DFIR
GRC
Talk
Open →
2023-05
58:25
Characteristics of Emotet Infections
Brad Duncan
BSides Augusta
· 2022
Technical
DFIR
Malware Analysis
Threat Intel
Case Studies and Incidents Analysis
Technical Deep-dives
Talk
Open →
2022-10
47:45
Windows 10 DFIR and InfoSec Challenges
Andrew Case
BSides Las Vegas
· 2019
Technical
DFIR
Malware Analysis
Blue
Technical Deep-dives
Talk
Open →
2019-10
55:44
Fernando Tomlinson - Gaining 20/20 vision during an incident with PowerShell
Fernando Tomlinson
BSides Augusta
· 2019
Technical
DFIR
Detection Engineering
Malware Analysis
Blue
Talk
Open →
2019-10
25:56
How to take cookies from the Cookie Monster: Genesis Market Takedown
John Fokker
BSides TLV
· 2023
War Stories
DFIR
Malware Analysis
Threat Intel
Blue
Case Studies and Incidents Analysis
Talk
Open →
2023-07
1:27:23
Analyzing Maldocs: Macro-soft Edition
Syed Hasan
BSides Pakistan
· 2021
Technical
DFIR
Malware Analysis
Reverse Engineering
Blue
Talk
Open →
2021-11
23:03
The Little Phone That Could Ch-ch-chroot
Mathew Evans
Jack Whitter-Jones
BSides London
· 2019
Technical
DFIR
Mobile Security
Threat Modeling
Advanced
Red
Talk
Open →
2019-06
57:51
Will Schroeder & Max Harley - Meet Your Nemesis: Fighting Data With Data
Will Schroeder
Max Harley
BSides Augusta
· 2023
Technical
DFIR
Threat Intel
Advanced
Red
Talk
Open →
2023-10
23:23
Why should I care about my Metadata?
Conor Aitken
BSides Perth
· 2023
Technical
DFIR
Threat Intel
Talk
Open →
2023-08
29:35
From Hours To Minutes: Automating Incident Response Triage With Open-Source Tools
Markus Einarsson
BSides Munich
· 2025
Technical
DFIR
Detection Engineering
Threat Intel
Blue
Talk
Open →
2026-02
16:07
Disabling Drones: Disruption and Forensic Data Analysis
Paavai Aram
BSides London
· 2025
Technical
DFIR
Vulnerability Research
Wireless Security
Red
Case Studies and Incidents Analysis
Technical Deep-dives
Demo
+1
Open →
2025-02
45:12
Choose Your Own Adventure: Group Interactive IR Scenario
Bryson Bort
BSides Tampa
· 2024
Technical
DFIR
Threat Intel
Intro
Blue
Workshop
Open →
2024-04
29:07
SOC Analyst's Arsenal: Essential Tools, Tips & Tricks For Effective Investigations
Samuel Kavaler
BSides Munich
· 2023
Technical
DFIR
Detection Engineering
Tooling
Intermediary
Blue
Talk
Open →
2023-10
50:01
Grapl — A Graph Platform for Detection and Response
Colin O'Brien
BSides Las Vegas
· 2019
Technical
DFIR
Detection Engineering
Threat Intel
Blue
Talk
Open →
2019-10
49:49
Closing the Visibility Gap: Threat Hunting with Hawk in the Microsoft Cloud
Jonathan Butler
Lorenzo
Paul Navarro
BSides Charm
· 2025
Technical
Tooling
Cloud IAM
DFIR
Detection Engineering
Threat Hunting
Intermediary
Blue
+2
Open →
2025-05
38:30
Maximising the Impact of OSINT in Investigations
Ruth McAlister
BSides Belfast
· 2023
Research
Technical
DFIR
OSINT
Threat Intel
Case Studies and Incidents Analysis
Empirical Research
Talk
Open →
2023-11
20:27
Georgios Karantzas - It's Duck Season: Forensic Detection of BadUsb Attacks
Georgios Karantzas
BSides TLV
· 2023
Technical
DFIR
Detection Engineering
Hardware Hacking
Talk
Open →
2023-07
27:21
Blue Team Keynote by Lisa Forte
Lisa Forte
BSides Leeds
· 2023
Technical
DFIR
Threat Intel
Blue
Keynote
Open →
2023-07
24:20
Google Workspace Forensics – Insights from Real-World Hunts & IR
Ariel Szarf
Doron Karmi
BSides TLV
· 2023
Technical
Cloud IAM
DFIR
Case Studies and Incidents Analysis
Technical Deep-dives
Talk
Open →
2023-07
34:13
From Panic To Protocol: Digital Forensics & Incident Response
Rory Wagner
BSides Leeds
Technical
DFIR
Intro
Blue
Talk
Open →
2024-08
55:01
Intel AMT: Using & Abusing the Ghost in the Machine
Parth Shukla
BSides Lisbon
· 2017
Technical
DFIR
Hardware Hacking
Advanced
Talk
Open →
2017-11
38:29
We Take Your Security Seriously (Or Do We?) — The Beer Farmers
BSides Scotland
· 2019
Community
War Stories
DFIR
Privacy
Threat Intel
Intro
Case Studies and Incidents Analysis
Talk
Open →
2019-04
53:27
Unparalleled Remote Desktop Monitoring: Revealing Attackers' Tradecraft
Olivier Bilodeau
Adrian Beron
BSides Augusta
· 2023
Research
DFIR
Malware Analysis
Network Security
Threat Intel
Blue
Case Studies and Incidents Analysis
Empirical Research
+1
Open →
2023-10
40:07
Navigating the Shadows: KYC, AML, and Cyber Threat Intelligence
Jonathan Gonzalez
BSides SATX
· 2024
Technical
DFIR
Threat Intel
Talk
Open →
2024-06
36:05
Not BigData, AnyData
Martin Holste
BSides Augusta
· 2013
Technical
DFIR
Detection Engineering
Threat Intel
Intermediary
Blue
Talk
Open →
2013-09
29:09
DFIR in 2022: The Wild Wild East
Jack Rutherford
Richard Grainger
BSides Sydney
· 2022
Technical
DFIR
Malware Analysis
Threat Intel
Blue
Case Studies and Incidents Analysis
Talk
Open →
2023-03
53:55
The Evolution of Cyber Security and What to Expect Next
Eric Eifert
BSides Athens
· 2026
Career
DFIR
Threat Intel
Case Studies and Incidents Analysis
Keynote
Open →
2024-03
45:20
SocVel Live: Command The Breach
Jaco Swanepoel
BSides Joburg
Technical
DFIR
Detection Engineering
Threat Intel
Blue
Workshop
Open →
2025-09
49:09
Rastrea2r: Multi-Platform Threat Hunting and Incident Response
Sudheendra S Bhat
BSides PDX
· 2018
Technical
DFIR
Threat Intel
Talk
Open →
2019-02
24:10
Digital Forensics: Myths, Legends and Reality
Lauren Spokes
BSides Newcastle
· 2025
Technical
War Stories
DFIR
Blue
Case Studies and Incidents Analysis
Talk
Open →
2025-01
19:28
Malware Infection, Visualized
Xavier Ashe
BSides Atlanta
· 2015
Technical
DFIR
Detection Engineering
Malware Analysis
Blue
Talk
Open →
2015-04
16:59
DanderSpritz: A case study in Nation State Post-Exploitation Framework Capabilities & Defense Strategies
Francisco Donoso
BSides KC
· 2018
Technical
DFIR
Malware Analysis
Threat Intel
Advanced
Red
Case Studies and Incidents Analysis
Technical Deep-dives
+1
Open →
2018-06
26:06
DarkEngine: Conducting Research into a Highly Orchestrated Phishing Campaign
Liam Wilkinson
BSides Canberra
· 2025
Research
DFIR
Malware Analysis
Social Engineering
Threat Intel
Case Studies and Incidents Analysis
Technical Deep-dives
Talk
Open →
2025-12
48:20
Victim of Your Own Cyberattack
Henrik Noben
Stephan Van Dyck
BSides Tallinn
· 2025
Technical
DFIR
Threat Intel
Blue
Case Studies and Incidents Analysis
Talk
Open →
2025-10
16:01
How Digital Forensics And A Batch Script Helped Me Understand The Infection Chain - Ataur Rahman
Ataur Rahman
BSides London
· 2025
Technical
DFIR
Malware Analysis
Intermediary
Case Studies and Incidents Analysis
Talk
Open →
2026-03
59:53
USB Device Analysis
James Habben
BSides SLC
· 2017
Technical
DFIR
Hardware Hacking
Malware Analysis
Intermediary
Blue
Case Studies and Incidents Analysis
Methodology
+1
Open →
2017-06
40:24
Deductive Reasoning: File Analysis Techniques
John Laycock
Chris Rogers
BSides DC
· 2015
Technical
DFIR
Malware Analysis
Intro
Talk
Open →
2015-11
29:55
SOCs and Shoes
Shawn Thomas
BSides Charm
· 2022
Career
DFIR
Detection Engineering
Blue
Talk
Open →
2022-07
47:07
True Story: I Saw Phishing Done by a Panda(Doc)
Fernando Tomlinson
BSides Augusta
· 2022
Technical
DFIR
Social Engineering
Intermediary
Blue
Case Studies and Incidents Analysis
Talk
Open →
2022-10
49:35
OSINT for Incident Investigations
Patterson Cake
BSides Knoxville
· 2024
Technical
DFIR
OSINT
Threat Intel
Case Studies and Incidents Analysis
Talk
Open →
2024-12
45:14
The Art of Infiltration: Leveraging Trusted Relationships
Vladimir Ožura
BSides Zagreb
Technical
Active Directory
DFIR
Threat Intel
Blue
Case Studies and Incidents Analysis
Talk
Open →
2025-03
23:53
Applying Sysmon-type Filtering to Elastic Agent Process Auditing
Josh Brower
BSides Augusta
· 2023
Technical
DFIR
Detection Engineering
Blue
Demo
Talk
Open →
2023-10
18:07
Ransomware incidents demystified
Thanassis Diogos
BSides Athens
· 2021
War Stories
DFIR
Malware Analysis
Threat Intel
Case Studies and Incidents Analysis
Talk
Open →
2021-07
21:54
Google Workspace Forensics – Insights from Real-World Hunts & IR
Doron Karmi
Ariel Szarf
BSides Las Vegas
· 2023
Technical
Cloud IAM
DFIR
Threat Intel
Case Studies and Incidents Analysis
Technical Deep-dives
Talk
Open →
2023-10
View all 237 talks tagged DFIR →
[ feedback ]
Spotted a wrong year, missing speaker, broken link, or anything off? Send a quick note.
From:
Subject:
Message:
Send →
