Pages

▼
Friday, October 30, 2015

OSDFCon follow-up

›
I attended Basis Tech's OSDFCon recently...I've attended and presented at this conference in the past ...and as has been the case i...
4 comments:
Thursday, October 08, 2015

Threat Intel and Threat Hunting Conferences in 2016

›
I'm looking for input from the community, with respect to conferences in 2016 that cover DFIR, threat intelligence, and threat hunting. ...
7 comments:
Tuesday, October 06, 2015

Tools, Links - ESEDB, etc.

›
Tools CapLoader - This looks like an interesting tool...and another one...for carving packets from memory dumps.  I'm not clear as to ...
1 comment:
Saturday, September 12, 2015

Updates, Links, etc.

›
RegRipper Plugin Updates I updated a plugin recently and provided a new one, and thought I'd share some information about those updates...
5 comments:
Saturday, September 05, 2015

Registry Analysis

›
I gave a presentation on Registry analysis at the recent HTCIA2015 Conference, and I thought that there were some things from the presentat...
Wednesday, September 02, 2015

HTCIA2015 Conference Follow up

›
I spoke at the HTCIA 2015 conference , held in Orlando, FL, on Mon, 31 Aug.  In fact, I gave two presentations ...Registry analysis, and ...
Friday, August 28, 2015

Updates & Links

›
HTCIA2015 Presentations For those of you attending  HTCIA2015  (or just interested), I printed my presentations to PDF format and uploaded ...
Sunday, August 16, 2015

Updates

›
RegRipper Plugin Updates I made some updates to a couple of plugins recently.  One was to the networklist.pl/networklist_tln.pl plugins; th...
Sunday, July 26, 2015

BSidesCincy Follow up

›
I had the distinct honor of speaking at  @BSidesCincy this past weekend, and I greatly appreciate the opportunity that  Justin , Josh, and ...
11 comments:
Monday, July 13, 2015

Ghost Busting

›
First, read Jack's post, Don't wait for an intrusion to find you . Next, read this post ( The Blue Team Myth ). Notice any simil...
4 comments:
Tuesday, June 23, 2015

The Blue Team Myth

›
The 2015 M-Trends Report  states that the median number of days that threat groups were present in a victim's network before detection w...
1 comment:
Monday, June 22, 2015

Hunting, and Knowing What To Hunt For

›
Like many others of my generation, when I was a kid I'd go and play outside for hours and hours.  Sometimes, while running through the w...
6 comments:
Thursday, June 11, 2015

RegRipper plugin update

›
I just pushed out an update to the appcompatcache.pl plugin, and committed it to the Github archive.  The update was based on a request I...
Sunday, June 07, 2015

Links

›
SANS DFIR Poster If you haven't heard, the new SANS DFIR "Evidence of..." poster is available.  I can see looking at the sec...
23 comments:
Thursday, May 28, 2015

Detecting Lateral Movement

›
Almost two years ago, I posted this article that addressed how to track lateral movement  within an infrastructure.  At the time, I'd be...
5 comments:
Tuesday, May 26, 2015

Links and Stuff

›
Registry Goodness I recently wrote a RegRipper plugin, based on this KB article ; on 26 May, I committed it to the plugin repository.  I h...
Tuesday, May 05, 2015

Stuff

›
Plugin Updates Eric Zimmerman reached to me a little while ago and let me know that he'd taken a look at the AppCompatCache data fro...