Pages

▼
Saturday, July 04, 2026

Finding Initial Access

›
I recently ran across a comment from a SOC manager on social media that said, "Finding initial access is difficult." I thought abo...

LNK Files in CTI

›
There's a good bit of file analysis that goes into CTI reports, including (but not limited to) malware analysis. But for some reason, no...

Rigor in Threat Intel

›
I'm just going to say it. IOCs are not "threat intel".  Lists of IP addresses and domain names, without context, are data poin...
Saturday, June 27, 2026

Consistency

›
I've worked a lot of places over the years, all for varying lengths of time. While this worked against me in the early days, with potent...
Friday, June 19, 2026

Timelines

›
I like timelines, particularly when it comes to forensic investigations.  There I said it. The first step to addressing an issue is admittin...
Tuesday, March 10, 2026

LNK Files

›
I know what you're thinking..."LNK files? Again? Dude, you are like a dog with a bone!" Yes. Yes, I am. But in this case, I...

Links

›
I've been saving some things up in this draft blog post, adding new things, removing some older stuff that, after a few days, didn't...
Monday, February 02, 2026

Devices

›
Something I learned very early on as a DF/IR consultant was that you're likely never going to run into a perfect environment as an on-ca...
2 comments:
Monday, January 19, 2026

Views on AI & the Anthropic Report

›
There's been a lot of chatter over the use of AI in various fields, and because it's my professional focus, I'm most interested ...
Saturday, January 10, 2026

What's on your clipboard?

›
One of the fascinating aspects of Windows systems, from a DF/IR perspective, for me has been the clipboard. Notice I said, "one of...
1 comment:
Monday, January 05, 2026

Questions I've Been Asked

›
Sometimes I'll get questions via different routes...webinars or podcasts, via social media, DM, or even email. Getting questions is good...
2 comments:
Thursday, January 01, 2026

Windows Defender Support Logs

›
I ran across a LinkedIn post the other day that  mentioned using Windows Defender Support Logs (actually, I think the post referred to them...

Grab Bag

›
This started out as a bit of an end-of-the-year grab bag of posts, but I don't like simply linking to things, dropping links with no exp...
1 comment:
Monday, December 29, 2025

Question on Open Source Tools

›
I received a question recently, one I receive every now and again, asking if there are any updates to an open source tool I created a while ...
Thursday, December 11, 2025

Perspectives on Cybersecurity

›
I'm not a fan of many podcasts. I do like a conversational style, and there are some podcasts that I listen to, albeit not on a regular ...