Pages

▼
Tuesday, April 14, 2020

Registry Analysis, pt II

›
In my last blog post , I provided a brief description of how I perform "Registry analysis", and I thought it would be a good idea ...
Sunday, April 12, 2020

Registry Analysis

›
When you see the words, "Registry analysis", what comes to mind?  Okay, now...what actually happens when we 'do' this t...
Sunday, April 05, 2020

Going Beyond

›
As an industry and community, we need to go beyond...go beyond looking at single artifacts to indicate or justify "evidence", and ...
Wednesday, March 11, 2020

Ransomware

›
Hardly a week (sometimes a day??) passes without some mention of ransomware, and another organization or municipality (or three) feeling the...
Tuesday, March 10, 2020

Revisiting Program Execution

›
As I prepare a presentation for a government agency, I've been thinking quite a bit about the idea of "program execution".  I...
Thursday, February 20, 2020

RegRipper Update

›
Based on a Twitter thread from 19 Feb 2020, during which Phill Moore made the request, I updated RegRipper to check for "dirty" h...
Monday, February 17, 2020

RID Hijacking

›
I read a fascinating blog post recently that described something called RID hijacking , which can be used as a method for maintaining elevat...
Saturday, February 15, 2020

Using Intrusion Intelligence

›
In his book, "Call Sign Chaos", Jim Mattis made the statement that 'your own personal experiences are not enough to sustain yo...
3 comments:
Thursday, February 13, 2020

Update: Prefetch + Stealth ADS Analysis

›
Not long ago, I took at look at an image that Dr. Ali Hadi had put together to demonstrate an aspect of digital analysis to his students.  ...
Tuesday, January 28, 2020

"Hidden" Prefetch File Analysis and Alternate Data Sources

›
One of the things I like to do is engage in DFIR analysis of CTF and challenge images, just to see what pops out and what new things I can l...
2 comments:
Monday, January 27, 2020

Developing and Using Lessons Learned

›
From the very beginning of my time in DFIR, and even before then, I saw the value in having some form of "lessons learned" process...
Saturday, January 04, 2020

First RegRipper 2020 Update

›
'cogphn' recently reached to me via the RegRipper GitHub repo to let me know that they'd found an issue with a plugin, and this ...
2 comments:
Tuesday, December 31, 2019

Maintaining The KnowledgeBase

›
As 2019 closes, we move into not just a new year, but also a new decade.  While, for the most part, this isn't entirely significant...af...
Sunday, December 29, 2019

LNK Toolmarks

›
Matt posted a blog article a while back, and I took interest in large part because it involved an LNK file.  Matt provided a hash for the f...
Saturday, December 28, 2019

Improving DFIR Skills

›
There are more than a few skills that make up the #DFIR "field", and just one of them is conducting DFIR analysis.  Brett Shavers ...
2 comments:
Wednesday, December 25, 2019

What is "best"?

›
A lot of times I'll see a question in DFIR-related social media, along the lines of, "what is the best tool to do X ?"  I'...
2 comments:
Tuesday, December 03, 2019

Artifact Clusters

›
Very often within the DFIR community, we see information shared (usually via blog posts) regarding a "new" artifact that has been ...
2 comments: