Pages

▼
Monday, April 12, 2021

On #DFIR Analysis, pt III - Benefits of a Structured Model

›
 In my previous post , I presented some of the basic design elements for a structured approach to describing artifact constellations, and le...
1 comment:
Saturday, April 10, 2021

On #DFIR Analysis, pt II - Describing Artifact Constellations

›
 I've been putting some serious thought into the topic of a new #DFIR model, and in an effort to extend and expand upon  my previous pos...
2 comments:
Thursday, April 01, 2021

LNK Files, Again

›
 I ran across SharpWebServer via Twitter recently...the first line of the readme.md file states, "A Red Team oriented simple HTTP ...

On #DFIR Analysis

›
I wanted to take the opportunity to discuss DFIR analysis; when discussing #DFIR analysis, we have to ask the question, "what _is_ ...
6 comments:
Tuesday, March 23, 2021

Extracting Toolmarks from Open Source Reporting, pt II

›
On the heels of my previous post on this subject, I ran across this little gem  from Microsoft regarding the print spooler EOP exploitation...
Thursday, January 28, 2021

Extracting Toolmarks from Open Source Intel

›
I've talked about toolmarks before...what they are, why (I believe) they're important, that sort of thing.  I've also described...
Monday, November 23, 2020

Speaking at Conferences, 2020 edition

›
As you can imagine, 2020 has been a very "different" year, for a lot of reasons, and impacts of the events of the year have extend...
2 comments:
Tuesday, November 10, 2020

Happy Birthday, Marine Corps!

›
  I thought today of all days would be a good time to break from tradition and share a post that has nothing to do with DFIR or Windows, one...
1 comment:
Wednesday, October 21, 2020

Name Resolution

›
How often to DFIR analysts think about name resolution, particularly on Windows systems?  I know that looking back across engagements I'...
7 comments:
Sunday, October 11, 2020

Settings That Impact The Windows OS

›
There are a number of settings within Windows systems that can and do significantly impact the functionality of Windows, and as a result, ca...
2 comments:

#OSDFCON

›
 The agenda for the 11th annual Open Source Digital Forensics Conference  has been posted.  I've attended OSDFCON before  (several times...
2 comments:
Saturday, September 19, 2020

Toolmarks

›
 I recently ran across an interesting article from Sophos , indicating that the Maze ransomware threat group had taken a page from the Ragna...
Monday, August 31, 2020

The Death of AV??

›
I had a conversation recently, which started out being about endpoint technologies.  At one point in the conversation, the topic of AV came ...
1 comment:
Sunday, August 16, 2020

Toolmarks: The "How"

›
 I recently published a post where I discussed DFIR  toolmarks , and not long after sharing it on Twitter, someone asked me for a list of re...
1 comment:
Wednesday, August 05, 2020

Toolmarks and Intrusion Intelligence

›
Very often, DFIR and intel analysts alike don't appear to consider such things as toolmarks associated with TTPs, nor intrusion intellig...
1 comment:
Tuesday, July 07, 2020

On Artifact Constellations And "Toolmarks"

›
Something I've been pretty focused on in my analysis for some time is the concept of "artifact constellations".  I originally ...