Pages

▼
Thursday, July 03, 2025

RegRipper

›
The awesome folks over at Cyber Triage recently published their 2025 Guide to Registry Forensic Tools , and being somewhat interested in th...
Monday, June 30, 2025

Hunting Fileless Malware

›
I ran across Manuel Arrieta 's Hunting Fileless Malware in the Windows Registry article recently, and found it to be an interesting rea...
Thursday, June 26, 2025

Program Execution, follow-up pt II

›
On the heels of my previous post on this topic, it occurred to me that this tendency to incorrectly refer to ShimCache and AmCache artifact...
Wednesday, June 25, 2025

Program Execution, follow-up

›
 Last Nov, I published a blog post titled Program Execution: The ShimCache/AmCache Myth  as a means of documenting, yet again and in one pla...

I've Seen Things, pt II

›
As a follow-on to my previous post with this title, I wanted to keep the story going; in fact, there are likely to be several more posts in...
Monday, May 26, 2025

I've Seen Things

›
I like the movie "Blade Runner". I've read Philip K. Dick's " Do Androids Dream of Electric Sheep ", on which th...
Thursday, March 20, 2025

Know Your Tools

›
In 1998, I was in a role where I was leading teams on-site to conduct vulnerability assessments for organizations. For the technical part of...
Monday, March 17, 2025

WMI

›
The folks over at CyberTriage recently shared a complete guide to WMI ; it's billed as a "complete guide to WMI malware", and ...
Monday, March 10, 2025

The Problem with the Modern Security Stack

›
I read something interesting recently that stuck with me. Well, not "interesting", really...it was a LinkedIn post on security sal...
1 comment:
Wednesday, February 19, 2025

Lina's Write-up

›
Lina recently posted on LinkedIn that she'd published another blog post . Her blog posts are always well written, easy to follow, fas...
Sunday, February 16, 2025

The Role of AI in DFIR

›
The role of AI in DFIR is something I've been noodling over for some time, even before my wife first asked me the question of how AI wou...
Monday, January 20, 2025

Artifacts: Jump Lists

›
In order to fully understand digital analysis, we need to have an understanding of the foundational methodology, as well as the various cons...
Monday, January 06, 2025

Carving

›
Recovering deleted data, or "carving", is an interesting digital forensics topic; I say "interesting" because there are ...
Tuesday, December 24, 2024

UEPOTB, LNK edition

›
A while back, Jesse Kornblum published a paper titled, " Using Every Part of the Buffalo in Windows Memory Analysis ". This was, a...