Chris Daywalt

Chris Daywalt

Instructor
Security Freelancer

Chris Daywalt is a security freelancer in the defensive space who spends much of his day doing and teaching Digital Forensics and Incident Response (DFIR).

18,558
STUDENTS
16
COURSES
Chris Daywalt's Courses
Automated Archive and Exfiltration
Automated Archive and Exfiltration
Once an adversary has firmly established access within a target environment and identified data of ...
2CEUs
Ransomware with Recovery Disruption
Ransomware with Recovery Disruption
After an adversary has exfiltrated data from a target system, the potential final stages in ...
2CEUs
Using LOLbins for Tool Downloads
Using LOLbins for Tool Downloads
LOLbins won't have you laughing when threat actors "live off the land" to leverage tools ...
1CEUs
Local Account Discovery, Creation, and Manipulation
Local Account Discovery, Creation, and Manipulation
After gaining initial access on a system, adversaries may want to do some discovery work ...
2CEUs
Persistence via Windows Services
Persistence via Windows Services
Windows Services are the main vehicle used by the Windows OS to start and run ...
1CEUs
System Binary Proxy Execution and a Spearphish Payload
System Binary Proxy Execution and a Spearphish Payload
Spearphishing is one of the oldest tricks in the book, and in this course you ...
2CEUs
Compromise Software Supply Chain
Compromise Software Supply Chain
Threat actors use the technique Compromise Software Supply Chain by altering software that they know ...
1CEUs
Application Layer Protocol for C2 and Exfil to Cloud
Application Layer Protocol for C2 and Exfil to Cloud
Threat actors like APT29 use Application Layer Protocols for Command and Control (C2) so they ...
1CEUs
Unsecured Credentials and Domain Accounts
Unsecured Credentials and Domain Accounts
Threat actors use the techniques Unsecured Credentials and Domain Accounts to obtain credential access and ...
1CEUs
Disable Windows Event Log and Timestomp
Disable Windows Event Log and Timestomp
Sophisticated threat actors like APT29 will use the techniques Disable Windows Event Logging and Timestomp ...
1CEUs
Lateral Movement: Windows Remote Management
Lateral Movement: Windows Remote Management
In order to achieve lateral movement, threat actors will use a valid account to access ...
1CEUs
About Chris Daywalt

After too many years of security operations work, Chris Daywalt tries to turn his phone off at 5:00 pm EST. While there are a bunch of training classes and education somewhere on his resume (including CTT+ and Cellebrite certifications), much of what he has to teach was learned at the school of hard knocks, often at the expense of his previous clients. He wants to help you spend more time detecting and denying adversaries and less time banging your head against your keyboard. He dips his blueberry donuts in orange juice.

Chris’ 19-year career includes work for organizations of all sizes, both government and private sector, and is distributed roughly like so:

  • 30% doing DFIR
  • 30% teaching DFIR
  • 20% monitoring and detection engineering
  • 15% risk assessment
  • 5% other stuff, like sneaking in a game of Plants vs. Zombies or taking a quick nap at the desk (Don’t judge - I work overtime)