Pages

▼
Thursday, March 20, 2025

Know Your Tools

›
In 1998, I was in a role where I was leading teams on-site to conduct vulnerability assessments for organizations. For the technical part of...
Monday, March 17, 2025

WMI

›
The folks over at CyberTriage recently shared a complete guide to WMI ; it's billed as a "complete guide to WMI malware", and ...
Monday, March 10, 2025

The Problem with the Modern Security Stack

›
I read something interesting recently that stuck with me. Well, not "interesting", really...it was a LinkedIn post on security sal...
1 comment:
Wednesday, February 19, 2025

Lina's Write-up

›
Lina recently posted on LinkedIn that she'd published another blog post . Her blog posts are always well written, easy to follow, fas...
Sunday, February 16, 2025

The Role of AI in DFIR

›
The role of AI in DFIR is something I've been noodling over for some time, even before my wife first asked me the question of how AI wou...
Monday, January 20, 2025

Artifacts: Jump Lists

›
In order to fully understand digital analysis, we need to have an understanding of the foundational methodology, as well as the various cons...
Monday, January 06, 2025

Carving

›
Recovering deleted data, or "carving", is an interesting digital forensics topic; I say "interesting" because there are ...
Tuesday, December 24, 2024

UEPOTB, LNK edition

›
A while back, Jesse Kornblum published a paper titled, " Using Every Part of the Buffalo in Windows Memory Analysis ". This was, a...
Tuesday, November 26, 2024

Program Execution: The ShimCache/AmCache Myth

›
I recently saw another LinkedIn post from someone supporting and sending readers to a site that was reportedly started using the SANS DFIR ...
1 comment:
Thursday, October 31, 2024

FTSCon

›
I had the distinct honor and pleasure of speaking at the "From The Source" Conference (FTSCon) on 21 Oct, in Arlington, VA. This ...
Saturday, October 26, 2024

Artifact Tracking: Workstation Names

›
Very often in cybersecurity, we share some level of indicators of compromise (IOCs), such as IP addresses, domain names, or file names or ha...
Tuesday, October 15, 2024

Analysis Process

›
Now and again, someone will ask me, "...how do you do analysis?" or perhaps more specifically, "...how do you use RegRipper?...