Anti-Forensics (and Anti-Anti-Forensics) Techniques for Incident Responders

A full-spectrum dive into anti-forensics across Windows and Linux (with a tad of MacOS, if time permits), centered on real incidents and modern attacker behavior. The course walks through classic log wiping, deeper filesystem tricks, PowerShell, timestomping, sandbox artifacts, memory-only execution, endpoint solution blind spots, and advanced Linux log manipulation.

Each technique is paired with detection logic, weaknesses in attacker tradecraft, and practical forensic recovery paths. The material emphasizes hands-on analysis, including MFT/MSRUM/USN artifacts, ETW traces, VHDX extraction, /proc-based investigation, and highlights new research and tooling that shape current offensive and defensive strategies.

With many examples from real-world Incident Response cases, this course is an excellent addition to regular forensic classes.

Public Training

• BruCon Spring Training (More Information)

Syllabus

• Introduction & Context
• Simple Anti-Forensics
• File Deletion & NTFS Internals
• Detection & Analyst Artifacts
• PowerShell Traces
• Microsoft Defender (MP) Logs
• Timestomping in Depth
• Additional Windows Artifacts
• Windows Sandbox & VHDX Forensics
• WSL & Service Abuse
• Exotic & Overlooked Artifacts
• Linux Anti-Forensics
• Advanced Loading & Evasion

Audience

Incident responders and SOC Analysts who want to learn more about (obscure) forensic artifacts, to be a step ahead of the threat actors. Based on real-life experience, this course goes beyond a regular forensic class.

Enquiries

Contact us to schedule a private delivery or request tailoring.