Pages

▼
Thursday, September 22, 2016

Size Matters

›
Yes, it does, and sometimes smaller is better. Here's why...the other day I was "doing" some analysis, trying to develop som...
2 comments:
Monday, September 19, 2016

Links/Updates

›
Malicious Office Documents Okay, my last post  really doesn't seem to have sparked too much interest; it went over like a sack of hamme...
1 comment:
Sunday, September 11, 2016

OLE...OLE, OLE, OLE!

›
Okay, if you've never seen The Replacements then the title of this post won't be nearly as funny to you as it is to me...but that...
Wednesday, September 07, 2016

More Updates

›
Timelines Mari had a great post recently that touched on the topic of timelines, which also happens to be the topic of her presentation at...
Saturday, September 03, 2016

Updates

›
Registry Settings Microsoft TechNet had a blog post recently regarding malware setting the IE proxy settings by modifying the "AutoCo...
1 comment:
Sunday, August 28, 2016

Links and Updates

›
Corporate Blogs Two cool things about my day job is that I see cool things, and get to share some of what is seen through the SecureWorks c...
Saturday, August 13, 2016

LANDesk in the Registry

›
LANDesk in the Registry Some of my co-workers recently became aware of information maintained in the Windows Registry by the LANDesk softmo...
3 comments:
Wednesday, August 10, 2016

Links

›
Data Exfil A question that analysts get from time to time is "was any data exfiltrated from this system?"  Sometimes, this can be...
3 comments:
Sunday, July 17, 2016

Updates

›
Book Update I recently and quite literally stumbled across an image online that was provided as part of a challenge, involving a compromise...
Wednesday, July 06, 2016

Updates and Stuff

›
Registry Analysis I received a question recently, asking if it were possible to manipulate Registry key LastWrite time stamps in a manner s...
7 comments:
Monday, June 20, 2016

New Book

›
So, yeah...I'm working on another book (go figure, right?).  This one is different than the previous books I've written ; rather th...
8 comments:

Updates

›
Data Hiding Techniques Something I caught over on Weare4n6 recently was that there's a new book on it's way out, due to be availa...
3 comments:
Wednesday, June 08, 2016

Updates

›
RegRipper Plugin Updates I recently released some updates to RegRipper plugins, fixing code (IAW Eric's recent post ) and releasing a...
Monday, June 06, 2016

Wait...There's More...

›
Tools Mari posted to her blog again not long ago, this time sharing a description of a Mac artifact, as well as a Python script that imple...
3 comments:
Sunday, June 05, 2016

Updates

›
RegRipper Plugins I recently created a new RegRipper plugin named lastloggedon.pl , which accesses the Authentication\LogonUI key in the S...