Skip to main content
MSRC

PowerShell

Acquiring a VHD to Investigate

Tuesday, September 03, 2019

In a previous post we described some of the differences between on-premises/physical forensics and cyber investigations and those performed in the cloud, and how this can make cloud forensics challenging. That blog post described a method of creating and maintaining a VM image which can be distributed to multiple regions, allowing you to deploy this pre-prepared machine to be used in an investigation in a matter of minutes.

Scalable infrastructure for investigations and incident response

Friday, August 30, 2019

Traditional computer forensics and cyber investigations are as relevant in the cloud as they are in on-premise environments, but the methods in which to access and perform such investigations differ. This post will describe some of the challenges of bringing on-premises forensics techniques to the cloud and show one solution to overcome these challenges, using Azure functionality.

Windows Defender Advanced Threat Protection の機械学習: 未知の侵入アクティビティの検出

Monday, December 25, 2017

本記事は、Windows Security のブログ “Windows Defender ATP machine learning: Detecting new and unusual breach activity” (2017 年 8 月 3 日 米