Phill Moore

Principal Security Researcher, Microsoft

Greater Sydney Area

About

Currently a security researcher at Microsoft, Certified SANS instructor for the FOR500 Windows Forensic Analysis and FOR528 Ransomware and Cyber Extortion classes, and a course author for the now retired SANS FOR308 Digital Forensics Essentials class. Previously, Senior Digital Forensics Analyst at NSWPF and principal investigator at CyberCX I also write a weekly blog post on the latest news in the DFIR space - thisweekin4n6.com my research blog is thinkdfir.com

Experience

  • Principal Security Researcher at Microsoft
    Nov 2025 - Present · 9 mos

  • Certified Instructor at SANS Institute
    Jul 2019 - Present · 7 yrs 1 mo

    Certified instructor at the SANS Institute for the Windows Forensic Analysis (FOR500) and Ransomware for Incident Responders (FOR528) courses Course author for Digital Forensics Essentials (FOR308) (retired)

  • Blogger at ThinkDFIR
    Aug 2017 - Present · 9 yrs

    My personal DFIR research blog

  • Blogger at This Week in 4n6
    Jan 2016 - Present · 10 yrs 7 mos

    Every week I share a brief summary (and sometimes my thoughts) on whats happening in the DFIR industry as shared by the myriad of bloggers and vendors around the world. Each month I compile a list of my favourite articles and record a short podcast explaining why I think they're important

  • CyberCX (Full-time · 6 yrs 7 mos)
    • Principal Investigator
      Sep 2022 - Nov 2025 · 3 yrs 3 mos

    • Lead Investigator
      May 2019 - Sep 2022 · 3 yrs 5 mos