Investigating Nix Endpoints for Incident Response - Patterson Cake
How many endpoint Operating Systems are there?
SPOILER alert – the answer is two!
🛝 Webcast Slides -
https://www.antisyphontraining.com/wp-content/uploads/2026/04/REI-Nix-042026.pdf
Join Patterson Cake, Director of Incident Response at Black Hills Infosec, as he guides through his “rapid endpoint investigations” workflow for the “other” (not Windows) Operating System…*Nix (Linux/Mac).
We’ll learn how to select, acquire, and analyze Linux and Mac investigative artifacts, using Velociraptor offline collector, CatScale, and UAC scripts.
Windows gets a lot of attention and rightfully so!
However, Linux and Mac are part of every enterprise ecosystem and represent a critical attack surface. You need a simple, effective, repeatable plan for investigating these endpoints.
Chapters
Credits
Chat with your fellow attendees in the BHIS Discord server:
https://discord.gg/bhis
in the #🔴live-chat channel
🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits –
https://poweredbybhis.com
Click here to watch a video of this episode.
Brought to you by:
SPOILER alert – the answer is two!
🛝 Webcast Slides -
https://www.antisyphontraining.com/wp-content/uploads/2026/04/REI-Nix-042026.pdf
Join Patterson Cake, Director of Incident Response at Black Hills Infosec, as he guides through his “rapid endpoint investigations” workflow for the “other” (not Windows) Operating System…*Nix (Linux/Mac).
We’ll learn how to select, acquire, and analyze Linux and Mac investigative artifacts, using Velociraptor offline collector, CatScale, and UAC scripts.
Windows gets a lot of attention and rightfully so!
However, Linux and Mac are part of every enterprise ecosystem and represent a critical attack surface. You need a simple, effective, repeatable plan for investigating these endpoints.
Chapters
- (00:00) - Intro - Investigating Nix Endpoints for Incident Response - Patterson Cake
- (00:31) - April is the cruelest month
- (02:24) - AGENDA
- (04:21) - ENDPOINT & IDENTITY
- (04:59) - ENDPOINT = ?
- (07:11) - OS = Windows vs Linux vs Mac?
- (08:48) - Linux “Use Cases”
- (10:29) - Endpoint Investigations: Linux
- (12:45) - Rapid Endpoint Investigations: Linux
- (13:37) - THREAT-ACTOR SOP*
- (17:15) - ENDPOINT ATTACK SURFACE
- (18:58) - RAPID TRIAGE WORKFLOW
- (20:07) - Linux Artifacts
- (22:14) - COLLECT...PARSE...REDUCE/REFINE
- (23:22) - COLLECT ARTIFACTS
- (27:02) - ANALYSIS WORKFLOW
- (27:49) - OUTPUT REVIEW
- (32:40) - Other = Mac (Business Desktops 10%)
- (34:35) - Mac “Threat-Actor SoP”
- (36:37) - Mac Artifacts
- (40:07) - Mac UAC Execution
- (41:55) - Mac Artificats (again)
- (50:30) - ENDPOINT & IDENTITY - Mac
- (52:32) - Resources
- (53:52) - Q&A
Credits
Chat with your fellow attendees in the BHIS Discord server:
https://discord.gg/bhis
in the #🔴live-chat channel
🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits –
https://poweredbybhis.com
Click here to watch a video of this episode.
Brought to you by:
Black Hills Information Security
Antisyphon Training
Active Countermeasures
Wild West Hackin Fest
Episode Video
Creators and Guests
Guest
Patterson Cake
Patterson Cake joined the Black Hills Information Security (BHIS) pirate ship in June of 2023 as a Security Consultant focusing primarily on detection engineering and digital forensics and incident response. He chose BHIS because, to paraphrase, “doing cool stuff with cool people” and “making the world a better/safer place” is exactly how he wants to spend his professional time and energy. It also helps that he has a bit of history with a couple of awesome folks that have been with BHIS for many moons. Prior to joining the team, Patterson helped build and lead a DFIR practice for an MSSP, worked as a senior security engineer for AWS Managed Services, and spent several years in enterprise cybersecurity, often healthcare related, focusing on intermingling offensive security and incident response in technical and leadership roles. Outside of work, he enjoys spending time with his family, which often involves motorcycles, outdoor sports, movies, and music.