🚨 I'm teaching SANS FOR577: Linux Incident Response & Threat Hunting in Virginia Beach, VA August 24-29, this will be the first public run with completely updated course material.

What's new:

🪨 Expanded btrfs coverage — not just artifacts, but the tools you can actually use to examine disk images containing btrfs filesystems. Btrfs is now the default on Fedora, openSUSE, and increasingly Ubuntu. If you've hit that tooling gap during a real investigation, this is for you.

🧪 All-new labs - rebuilt from the ground up

🏁 New capstone - a comprehensive, updated challenge that ties the course together

🤖 AI Investigations - a brand new section covering:

* LLM evidence artifacts
* Coding assistant forensics
* AI Agents & MCP (Model Context Protocol)
* Prompt injection attacks and how to investigate them

AI tools are already embedded in attacker workflows and user environments alike. Knowing how to find and interpret AI-related evidence is becoming a core DFIR skill.

🎤 Free SANS @night Talk — Aug 26 @ 6:00 PM
"Extending Protocol-SIFT to Linux" — Protocol-SIFT has been Windows-only. We're changing that.

💰 Save $500 with Early Bird code EarlyBirdNA — must pay by July 9, 2026

📍 Hilton Virginia Beach Oceanfront
📅 August 24-29, 2026

🔗 Register: https://www.sans.org/cyber-security-training-events/virginia-beach-2026

#DFIR #SANS #FOR577 #LinuxForensics #IncidentResponse #ThreatHunting #AIForensics #PromptInjection #btrfs #Cybersecurity #DigitalForensics #InfoSec #GLIR