[SANS Institute ]
Mike has been an instructor for the SANS Institute since 2008. He currently teaches Windows Forensics In-Depth(FOR500) and Advanced Digital Forensics and Incident Response (FOR508). In addition to teaching, Mike is a dedicated researcher and has published numerous articles for the SANS Forensics Blog. After spending much of his career working in large corporate environments in the oil & gas industry, Mike joined SANS in 2017 as a full-time researcher in the SANS Research Operations Center (SROC). His current role focuses on R&D projects in support of the Digital Forensics and Incident Response program. Mike is a researcher at heart and was extremely excited to join SANS in this capacity! Before joining SANS full-time, Mike led the US incident response team and the global internal investigations forensics team at Shell. Prior to Shell, Mike had several roles in IT at Halliburton, including senior incident responder for the last several years of his tenure there. Mike's core responsibilities were responding to malware and intrusion cases, leading various enterprise DFIR tooling projects, and consulting with internal groups on security reviews and initiatives. Over the years, Mike has accumulated a broad range of technical expertise, having spent significant time performing software quality assurance, Windows systems administration, LAN and WAN network administration, firewall and IDS/IPS security administration, computer forensic analysis, and incident response. As a forensic analyst, he worked HR investigations, including cases involving intellectual property theft, inappropriate use of the Internet, employee hacking, IT administrator privilege abuse, and illegal downloading of copyrighted materials. Mike holds a bachelor's degree in mechanical engineering from the University of Texas, as well as numerous IT security certifications. Tutorial: KAPE, Kansa and Velociraptor: a demonstration of free tools for digital forensics and incident response. Technical Level (3 being the highest score): 2 In this workshop, SANS Principal Instructor Mike Pilkington and SANS Certified Instructor Kevin Ripa will present rapid triage techniques for acquiring and analyzing hosts, both on an individual level and at scale across an enterprise network. The session will demonstrate several excellent free tools, including KAPE, Kansa, and Velociraptor. Each have some amazing capabilities, yet fill different complementary roles. Attendees will be able to follow along with many of the demonstrations. This four-hour interactive session will be conducted via the SANS Live Online platform.