Explore sessions and plan your time at RSAC™ 2026 Conference using the Full Agenda. Visit Create Your Schedule for details on favoriting vs. reserving a seat (when available), and how to secure your spot before the line closes 5 minutes prior to any session onsite.
 
See some amazing sessions you’d like to attend but need to upgrade your pass? Learn how.
Back to Session CatalogBack to Session Catalog
Forensic Adventures: Where Hackers Hide and Investigators Hunt - [HT-M03]
  • Monday, Mar 239:40 AM - 10:30 AM PDT
    Moscone West 3004
    Reserved Seating
Persistence is the attacker’s best friend and the defender’s nightmare. This session will draw on real-world incident response to show how intruders persist across endpoints, AD, and cloud. Attendees will learn to hunt artifacts, trace actions, and apply checklists to expose what attackers hope to hide, with fresh research on Automatic Destinations and the USN Journal.

Session Participant(s)

Type/Format: Track Session
Topic/Track: Cloud Security, Hackers & Threats, Incident Management
Pass Requirement: All AccessCISO Boot CampCyber Leaders ForumeFG All AccessESAFMedia: Press/AnalystSpeaker
Session Classification: Intermediate—Technical
Recording Status: Available On Demand