2026-09-19 –, Pupin
Have EDRs taken the glory of in-memory investigation? We' ll go through a side by-side comparison of of incident investigation with modern EDR against traditional memory forensics with volatility3.
(And by comparing we mean complimenting the knowledge and arsenal of blue teams to pick the right solution for the right problem. It's isn't really a competition on what is best, NOR a shameless product selling)
Theory is always good but gaining experience is also important!
We aim to start from memory internals 101 and dive into the analysis of a compromised system using volatility3 in parallel with KQL from Windows Defender for Endpoint. We showcase why memory forensics remains a solid option in incident response -even in the age of telemetry, and why rightfully considered an art form.
The workshop aims to be more than an RTFM of volatility3/KQL or use-plugin-and-find flags CTF, but rather equip participants with solid knowledge on linking pieces of evidence to fill the jigsaw puzzle of an incident.
Newbie or seasoned, professional or just curious, this session is for you!
The following topics will be covered:
Part 1: Memory structure
- How memory works in Windows systems
- Evidence in memory
Part 2: Memory in DFIR
- Investigation theory
- Introduction to Volatility3
- Differences with EDRs
Part 3: Hands-On workshop
Analysis of windows system
It is a BYOD session, so please have the latest version of volatility installed on your machine!
https://github.com/volatilityfoundation/volatility3
Access on the detection lab will be given during the workshop.
The workshop is not a nintendo-forensics class, It is all about how to use it, not install it! :)
I’ve always admired those that said “You will not have to work for the rest of your life if you make money from your hobby”. Especially if it meant a true “impact that matters” for people and their daily life. While it was fun to study and play with my friends in “Aggressive Cake” (a fitting name for a CTF team) as a freshman, it soon became apparent that reality is far from the innocent dream of doing what you love.
4 years forward, and really started wondering, if it would be better to become a fisherman. After all, the sea tides are less harsh than the life of a responder. Working overtimes to get the thrill of catching the bad guys was not worthy. Sometimes I really hope that AI takes this job (and auditing) away...
I like petting stray cats and watching sunsets.