Pages

▼
Thursday, October 31, 2024

FTSCon

›
I had the distinct honor and pleasure of speaking at the "From The Source" Conference (FTSCon) on 21 Oct, in Arlington, VA. This ...
Saturday, October 26, 2024

Artifact Tracking: Workstation Names

›
Very often in cybersecurity, we share some level of indicators of compromise (IOCs), such as IP addresses, domain names, or file names or ha...
Tuesday, October 15, 2024

Analysis Process

›
Now and again, someone will ask me, "...how do you do analysis?" or perhaps more specifically, "...how do you use RegRipper?&...

Rundown

›
I ran across a fascinating post from Cyber Sundae DFIR recently that talked about the Capability Access Manager, and how with Windows 11 it...
Wednesday, October 09, 2024

Exploiting LNK Metadata

›
Anyone who's followed me for a bit knows that I'm a huge proponent of metadata, and in particular, exploiting metadata in LNK files ...
Tuesday, October 08, 2024

Shell Items

›
I ran across a Cyber5W article recently titled, Windows Shell Item Analysis . I'm always very interested in not only understanding parsi...

RegRipper Educational Materials

›
A recent LinkedIn thread led to a question regarding RegRipper educational materials, as seen in figure 1; specifically, are there any. Fi...
Monday, July 08, 2024

What is "Events Ripper"?

›
I posted to LinkedIn recently (see figure 1), sharing the value I'd continued to derive from Events Ripper , a tool I'd written lar...
Monday, June 03, 2024

The Myth of "Fileless" Malware

›
Is "fileless" malware really fileless? Now, don't get me wrong...I get what those who use this term are trying to say; that ...
5 comments:
Thursday, March 21, 2024

A Look At Threat Intel Through The Lens Of Kimsuky

›
Rapid7 recently shared a fascinating post regarding the Kimsuky threat actor group making changes in their playbooks, specifically in their...

Threat Actors Dropping Multiple Ransomware Variants

›
I ran across an interesting LinkedIn post recently, "interesting" in the sense that it addressed something I hadn't seen a gre...
Friday, March 15, 2024

Uptycs Cybersecurity Standup

›
I was listening to a couple of fascinating interviews on the Uptycs Cybersecurity Standup podcast recently, and I have to tell you, there w...
Thursday, March 14, 2024

Investigative Scenario, 2024-03-12

›
Investigative Scenario Chris Sanders posted another investigative scenario on Tues, 12 Mar, and this one, I thought, was interesting (see th...
4 comments:
Monday, February 26, 2024

PCAParse

›
I was doing some research recently regarding what's new to Windows 11, and ran across an interesting artifact, which seems to be referre...
2 comments: