Pages

▼
Friday, June 25, 2021

What We Know About The Ransomware Economy

›
Okay, I think that we can all admit that ransomware has consumed the news cycle of late, thanks to high visibility attacks such as Colonial ...

Thoughts on Assessing Threat Actor Intent & Sophistication

›
I was reading this Splunk blog post recently, and I have to say up front, I was disappointed by the fact that the promise of the title (i.e...
Sunday, June 06, 2021

Toolmarks: LNK Files in the news again

›
 As most regular readers of this blog can tell you, I'm a bit of a fan of LNK files...a LNK-o-phile, if you will. I'm not only fasci...

Testing, and taking DFIR a step further

›
One of Shakespeare's lines from Hamlet I remember from high school is, "...there are more things on heaven and earth, Horatio, than...
Monday, April 12, 2021

On #DFIR Analysis, pt III - Benefits of a Structured Model

›
 In my previous post , I presented some of the basic design elements for a structured approach to describing artifact constellations, and le...
1 comment:
Saturday, April 10, 2021

On #DFIR Analysis, pt II - Describing Artifact Constellations

›
 I've been putting some serious thought into the topic of a new #DFIR model, and in an effort to extend and expand upon  my previous pos...
2 comments:
Thursday, April 01, 2021

LNK Files, Again

›
 I ran across SharpWebServer via Twitter recently...the first line of the readme.md file states, "A Red Team oriented simple HTTP ...

On #DFIR Analysis

›
I wanted to take the opportunity to discuss DFIR analysis; when discussing #DFIR analysis, we have to ask the question, "what _is_ ...
6 comments:
Tuesday, March 23, 2021

Extracting Toolmarks from Open Source Reporting, pt II

›
On the heels of my previous post on this subject, I ran across this little gem  from Microsoft regarding the print spooler EOP exploitation...
Thursday, January 28, 2021

Extracting Toolmarks from Open Source Intel

›
I've talked about toolmarks before...what they are, why (I believe) they're important, that sort of thing.  I've also described...
Monday, November 23, 2020

Speaking at Conferences, 2020 edition

›
As you can imagine, 2020 has been a very "different" year, for a lot of reasons, and impacts of the events of the year have extend...
2 comments:
Tuesday, November 10, 2020

Happy Birthday, Marine Corps!

›
  I thought today of all days would be a good time to break from tradition and share a post that has nothing to do with DFIR or Windows, one...
1 comment:
Wednesday, October 21, 2020

Name Resolution

›
How often to DFIR analysts think about name resolution, particularly on Windows systems?  I know that looking back across engagements I'...
7 comments:
Sunday, October 11, 2020

Settings That Impact The Windows OS

›
There are a number of settings within Windows systems that can and do significantly impact the functionality of Windows, and as a result, ca...
2 comments:

#OSDFCON

›
 The agenda for the 11th annual Open Source Digital Forensics Conference  has been posted.  I've attended OSDFCON before  (several times...
2 comments:
Saturday, September 19, 2020

Toolmarks

›
 I recently ran across an interesting article from Sophos , indicating that the Maze ransomware threat group had taken a page from the Ragna...
Monday, August 31, 2020

The Death of AV??

›
I had a conversation recently, which started out being about endpoint technologies.  At one point in the conversation, the topic of AV came ...
1 comment:
Sunday, August 16, 2020

Toolmarks: The "How"

›
 I recently published a post where I discussed DFIR  toolmarks , and not long after sharing it on Twitter, someone asked me for a list of re...
1 comment: