Pages

▼
Wednesday, January 30, 2019

RegRipper

›
I recently tweeted that, as far as I'm aware, Nuix's Workstation/Investigator product is the only commercial product that incorpora...
6 comments:
Tuesday, January 15, 2019

Just For Fun...

›
OS/2Warp running in VirtualBox When I started graduate school in June 1994, I showed up having used Win3.1 and AOL for dial-up.  While i...
2 comments:
Wednesday, January 09, 2019

A Tale of Two Analyses

›
I recently shared my findings from an analysis challenge that Ali posted , and after publishing my post, found out that Adam had also share...
1 comment:
Monday, January 07, 2019

Mystery Hacked System

›
Ali was gracious enough to make several of the challenges that he put together for his students available online , as well as for allowing m...
4 comments:
Tuesday, January 01, 2019

LNK Toolmarks, Revisted

›
There was a  recent blog post and Twitter thread regarding the parsing and use of weaponized LNK file metadata. Based on some of what was s...
Saturday, December 29, 2018

Parsing the Cozy Bear LNK File

›
November 2018 saw a Cozy Bear /APT29 campaign, discussed in FireEye's blog post regarding APT29 activity  (from 19 Nov 2018), as well as...
Friday, December 28, 2018

PUB File

›
Earlier this month, I saw a tweet that led me to this Trend Micro write-up regarding a spam campaign where the bad guys sent malicious MS P...
Wednesday, December 19, 2018

Hunting and Persistence

›
Sometimes when hunting, we need to dig a little deeper, particularly where the actor employs novel persistence mechanisms.  Persistence mec...
Tuesday, December 18, 2018

Updates

›
Based on some testing that Phill had done, I recently updated my Recycle Bin index file ($I*, INFO2) parser.  Since then, there have been s...
Saturday, November 24, 2018

Tool Testing

›
Phill recently posted regarding some testing that he'd conducted, with respect to tools for parsing Windows Recycle Bin files . From Ph...
Friday, November 23, 2018

Basic Skillz, pt II

›
Following my initial post on this topic, and to dove-tail off of Brett's recent post , I wanted to provide something of a consolidated ...
2 comments:
Tuesday, November 20, 2018

Basic Skillz

›
Based on some conversations I've had with Jessica Hyde and others recently (over the past month or so), I've been thinking a good b...
17 comments:
Saturday, November 17, 2018

Veteran Skillz

›
I had an interesting chat recently with a fellow Marine vet recently which generated some thoughts regarding non-technical skills that veter...
5 comments:
Tuesday, October 30, 2018

More Regarding IWS

›
IWS has been out for a short while now , and there have been a couple of reviews posted.  So far, it seems that there is some reticence to ...
3 comments:
Sunday, October 28, 2018

Updates

›
Book Discount While I was attending OSDFCon, I had a chance to (finally!) meet and speak with Jessica Hyde , a very smart and knowledgeable...
3 comments: