The first Mandiant Incident Response Conference (MIRCon…

I have the good fortune this week of being able to atte…

Cybercriminals are constantly innovating, developing ne…

As PowerShell power user James Honeycutt points out, Po…

In part 1, we looked at PowerShell get winevent to…

I. Core Architecture & Technical Innovations Advanc…

I. Architectural Innovations & Core Capabilities Ne…

In part 1, we looked at the PowerShell command to work …

WMI as an attack vector is not new. It has been used to…

We are excited to announce that the SANS Institute FOR5…