Identify the important Windows Event logs to hunt RDP lateral movement, both from the source and target system.

Investigate the puzzle pieces of RDP bitmap cache and how to stitch these together to get the (sorta) full picture.

Learn what the SUM UAL database is and how it can help make or break DFIR analysis.

Learn the mystery of the Amcache artifact and how to use it in your DFIR cases

Learn why visibility is everything when responding to an incident.

We've all heard of "Link" or "LNK" files, right? You want a faster way to open your favorite game, document or application without need...