The world's leading Digital Forensics and Incident Response provider. This feed updates you on latest DFIR news, events, and training.
Joined February 2009
- Tweets33.3K
- Following104
- Followers112K
- Likes4K
The gap between resilient orgs and everyone else comes down to how often they rehearse under pressure.
The ones that run incident simulations with ecosystem partners respond faster when it counts. #DFIR training at #SANSCDI is built around that readiness. go.sans.org/usHyyV
ALT Here is the alt text description: "Advertisement for SANS GIAC Cyber Defense Initiative event on December 14-19, 2026, in Washington, DC, or online. Highlights include statistics from the World Economic Forum: 44% of highly resilient organizations run incident simulations with partners, whereas only 16% of the least resilient do. Features a person presenting alongside computer screens.
Know where the evidence lives.
This FOR585 poster maps iOS and Android artifacts, retention, acquisition paths, SQLite queries, and free tools for investigating app data, device activity, and mobile malware.
👉 go.sans.org/TZlo1i
#MobileForensics #DFIR
SANS DFIR retweeted
I am EXTREMELY excited to announce that I am now officially a co-author for @sansforensics #FOR610: Reverse Engineering Malware!! In fact, @lennyzeltser and I have just completed a massive course update, which JUST went live online!
sans.org/cyber-security-cour…
AI doesn't always know when it is guessing.
See how analyst guidance, neutral questioning, and verification can keep confident AI output from becoming a bad malware analysis conclusion.
🔗 go.sans.org/gwZuPW
The six-step IR process has no instruction for the moment your scope breaks. @joswr1ght rebuilt it. The result is Dynamic Incident Response, a book introducing the Dynamic Approach to Incident Response (DAIR) model. Currently $0 on Kindle: amazon.com/dp/B0HK2V88SX
ALT The image features a book titled "Dynamic Incident Response: A Framework for Security Teams" by Joshua Wright, with an endorsement from SANS. Next to the book is a person smiling, framed in a circular cutout. The text highlights the book’s focus on modern incident response, authored by SANS faculty, and promotes that it's free to download, share, and adapt.
72% of teens have used an AI companion. It's built to keep them talking, not look out for them. 🤖 SANS expert @HeatherMahalik's fix: 3 real questions at dinner, not an interrogation. 🔒
go.sans.org/NUWmHW
#SecureTheFamily #CybersecurityAwarenessMonth #AISecurity
SANS DFIR retweeted
I came for the knowledge and left with a full ❤️ and sound mind. @sansforensics #DFIRSummit
📣 Deadline Extended! The SANS #CTISummit 2027 Call for Presentations is now open for another week!
Have research, a case study, new technique, tool, or lesson learned to share? We want to hear from you!
⏰ New Deadline: Oct. 26, 5 p.m. EDT
➡️ go.sans.org/Yvte5R
📣 #CTISummit Call for Presentations closes Monday.
What have you learned that could help another #CTI practitioner?
Share your case study, technique, tool, practical solution, or hard-earned lesson with the community.
⏰ Monday, Oct. 19, 5:00pm ETT
➡️ go.sans.org/PNfR2K
Ovie Carroll had AI open, edit, and save a Word doc. It left no LNK file, no Jump List entry, and no MRU record. More from the #DFIRSummit AI panel, plus the SANS frameworks for using AI safely in DFIR and IR: sans.org/go/ai-assisted-huma…
“Never trust. Verify.” — @maridegrazia
At #DFIRSummit, Mari, @ovie & Ray DePalma moderated by @HeatherMahalik challenged AI’s reliability.
AI finds artifacts. Investigators find the truth.
FREE DFIR + AI Frameworks:
sans.org/go/ai-assisted-huma…
No disk image, just an AI assistant leaking customer data. Raymond DePalma, author of the upcoming SANS FOR581, walked #DFIRSummit through the investigation: pause the agent, don't kill it, and read the trace before the config. github.com/depalmar
Finding real threats among thousands of alerts takes time.
At #DFIRSummit, Luis Garcia of Daylight Security showed how AI agents can help identify suspicious activity while analysts validate the evidence.
Join FREE Live Online: go.sans.org/d94eYp
#ThreatHunting
Stolen crypto leaves a trail.
At #DFIRSummit, Abdalla Alshamsi & Ahmed Belhay of Sharjah Police showed how digital evidence helped trace 20 BTC + 95 ETH stolen, recover assets & secure a conviction.
Join FREE Live Online: go.sans.org/d94eYp
A valid login doesn’t always mean legitimate activity.
At #DFIRSummit, we are exploring how stolen tokens let attackers access cloud data and why threat hunters must connect identity, token & cloud activity to detect abuse.
Join FREE Live Online: go.sans.org/d94eYp
SANS DFIR retweeted
My SANS DFIR Summit talk starts in a few hours! Glad to be joining as a featured speaker alongside such a great lineup.
I’ll be sharing some of my research into Developer Environments such as AI-assisted IDEs and coding tools—the forensic artifacts they leave behind, what agent telemetry can add to an investigation, and the gaps we still need to work through.
Stay tuned for an open-source tool drop too: DevEnvThreatCorpus, a project I’ve been building to help researchers and detection engineers explore developer-environment threats, source-backed attack paths, and telemetry opportunities.
Live Online registration is free and includes first access to approved recordings and decks. Hope to see you there!
go.sans.org/d94eYp
@sansforensics
#DFIRSummit #DFIR #AIAgents
🤖 Made with AI
SANS DFIR retweeted
Keynote just kicked off with Ray DePalma! Day 2 at the @sansforensics #DFIRsummit
SANS DFIR retweeted
My man Raymond DePalma is rocking his keynote at the @sansforensics #DFIRSummit 2026! If you aren't hanging out online with us, it's not too late to join us!
sans.org/cyber-security-trai…
Critical evidence can hide in hard-to-read logs.
At #DFIRSummit, Alexander Holcomb of @Mandiant showed how decoding Apple’s binary Unified Logs can reveal activity investigators might otherwise miss.
Join FREE Live Online: go.sans.org/d94eYp
#DFIR
