Pages

▼
Saturday, November 29, 2025

Intel in LNK Files

›
I was reading a pretty interesting write-up from Seqrite regarding, in part, the use of pseudo-polyglot documents. In this case, delivery o...
2 comments:
Wednesday, November 26, 2025

Registry: FeatureUsage

›
Maurice posted on LinkedIn  recently about one of the FeatureUsage  Registry key subkeys; specifically, the AppSwitched subkey. Being some...

Unprecedented Complexity

›
I saw it again, just today. Another post on social media stating that IT teams/defenders "face unprecedented complexity".  This on...

Thoughts on Analysis

›
Warning - before you get started reading this blog post, it's only fair that I warn you...in this post, I make the recommendation that y...
1 comment:
Thursday, November 13, 2025

Images

›
In writing Investigating Windows Systems , published in 2018, I made use of publicly available images found on the Internet. Some were image...
Wednesday, November 12, 2025

File Formats

›
I'm a huge fan of MS file formats, mostly because they provide for the possibility of an immense (and often untapped, unexploited) amoun...
Monday, November 10, 2025

What We Value

›
Over the passed couple of days, I've had images pop up in my feed showing people's workstations, most often with multiple screens. I...
3 comments:
Monday, November 03, 2025

Analysis Playbooks: USB

›
In 2005, Cory Altheide and I published the first peer-reviewed paper to address tracking USB devices on Windows systems. Over the years, it...
Friday, October 31, 2025

Registry Analysis

›
First off, what is "analysis"? I submit that "analysis" is what happens when an examiner has investigative goals and con...
Monday, October 27, 2025

Analyzing Ransomware

›
Not long ago, I ran across this LinkedIn post on analyzing a ransomware executable, which led to this HexaStrike post. The HexaStrike post...
2 comments:
Monday, September 01, 2025

Ransomware artifacts

›
I recently read through this FalconFeeds article on Qilin ransomware; being in DFIR consulting for as long as I have, and given how may ra...
Thursday, July 03, 2025

RegRipper

›
The awesome folks over at Cyber Triage recently published their 2025 Guide to Registry Forensic Tools , and being somewhat interested in th...
Monday, June 30, 2025

Hunting Fileless Malware

›
I ran across Manuel Arrieta 's Hunting Fileless Malware in the Windows Registry article recently, and found it to be an interesting rea...
Thursday, June 26, 2025

Program Execution, follow-up pt II

›
On the heels of my previous post on this topic, it occurred to me that this tendency to incorrectly refer to ShimCache and AmCache artifact...
Wednesday, June 25, 2025

Program Execution, follow-up

›
 Last Nov, I published a blog post titled Program Execution: The ShimCache/AmCache Myth  as a means of documenting, yet again and in one pla...

I've Seen Things, pt II

›
As a follow-on to my previous post with this title, I wanted to keep the story going; in fact, there are likely to be several more posts in...
Monday, May 26, 2025

I've Seen Things

›
I like the movie "Blade Runner". I've read Philip K. Dick's " Do Androids Dream of Electric Sheep ", on which th...