Pages

▼
Thursday, April 14, 2016

Training Philosophy

›
I have always felt that everyone, including DFIR analysts, need to take some level of responsibility for their own professional education....
Tuesday, April 12, 2016

Links

›
Ramdo I ran across this corporate blog post regarding the Ramdo click-fraud malware recently, and one particular statement caught my eye, ...
Tuesday, April 05, 2016

Cool Stuff, re: WMI Persistence

›
In case you missed it, the blog post titled, " A Novel WMI Persistence Implementation " was posted to the Dell SecureWorks web sit...

Windows Registry Forensics, 2E

›
Okay, the book is out !  At last!  This is the second edition to Windows Registry Forensics , and this one comes with a good bit of new mate...
5 comments:
Wednesday, March 23, 2016

Links

›
RegRipper Plugin Update Okay, this isn't so much an update as it is a new plugin.  Patrick Seagren sent me a plugin called cortana.pl ,...
Monday, March 14, 2016

Links and Stuff

›
Sysmon I've spent some time discussing MS's Sysmon in this blog, describing how useful it can be, not only in a malware testing en...
Sunday, March 13, 2016

Event Logs

›
I've discussed Windows Event Log analysis in this blog before ( here , and here ), but it's been a while, and I've recently been...
7 comments:
Wednesday, February 24, 2016

Links: Plugin Updates and Other Things

›
Plugin Updates Mari has done some fascinating research into MS Office Trust Records and posted her findings here . Based on her sharing her...
12 comments:
Friday, February 19, 2016

Links

›
Plugin Update Thanks to input (and a couple of hives) from two co-workers yesterday, I was able to update the appcompatcache.pl RegRipper ...
6 comments:
Tuesday, February 16, 2016

Tools, Links, From the Trenches, part deux

›
There's been considerable traffic online in various forums regarding tools lately, and I wanted to take a moment to not just talk about ...
11 comments:
Saturday, February 13, 2016

From the Trenches

›
I had an idea recently...there are a lot of really fascinating stories from the infosec industry that aren't being shared or documented ...
2 comments:
Wednesday, February 03, 2016

Updated samparse.pl plugin

›
I received an email from randomaccess last night, and got a look at it this morning.  In the email, he pointed out there there had been s...
10 comments:
Wednesday, January 27, 2016

The Need for Instrumentation

›
Almost everyone likes spies, right?  Jason Bourne, James Bond, that sort of thing?  One of things you don't see in the movies is the t...
Saturday, January 23, 2016

Training

›
On the heels of my Skills Dilemma blog post, I wanted to share some thoughts on training.  Throughout my career, I've been on both side...
6 comments: