Pages

▼
Sunday, January 23, 2022

The Threat Landscape and Attribution

›
Over the years, changes in the threat landscape have made attribution more difficult. Attribution has always been challenging, but has been ...
Wednesday, January 19, 2022

How Do You Know What "Bad" Looks Like?

›
From the time I started in DFIR, one question was always on the forefront of incident responder's minds... how do you know what "ba...
Monday, January 17, 2022

Registry Analysis - The "Why"

›
Why is Registry analysis important? The Windows Registry, in part, controls a good bit of the functionality of a Windows system. As such, Re...
3 comments:
Wednesday, December 22, 2021

On Writing DFIR Books, pt III

›
Editing and Feedback When it comes to writing books, having someone can trust to give you honest, thoughtful, insightful feedback is a huge ...
Saturday, December 18, 2021

Reasons to go looking in the Registry

›
Chris Sanders tweeted out an interesting pair of questions recently, and the simple fact is that for me to fully answer the question, the t...
Tuesday, December 14, 2021

Tips for DFIR Analysts, pt VI

›
Context & Finding Persistence I was looking into an unusual mechanism for launching applications recently, and that research brought bac...
Thursday, November 25, 2021

Threat Hunting, IRL

›
While I worked for one company, I did a lot of public speaking on the value of threat hunting. During these events, I met a lot of folks who...
Tuesday, November 23, 2021

Tips for DFIR Analysts, pt. V

›
Over the years, I've seen DFIR referred to in terms of special operations forces. I've seen incident response teams referred to as ...
2 comments:
Monday, November 01, 2021

Tips for DFIR Analysts, pt IV

›
Context is king, it makes all the difference. You may see something run in EDR telemetry, or in logs, but the context of when it ran in rel...
3 comments:
Sunday, October 10, 2021

Data Exfiltration, Revisited

›
I've posted on the topic of data exfiltration before ( here , etc.) but often it's a good idea to revisit the topic. After all, it w...
Friday, October 08, 2021

Tips for DFIR Analysts, pt III

›
Learn to think critically. Don't take what someone says as gospel, just because they say it. Support findings with data, and clearly com...

EDR Bypasses

›
During my time in the industry, I've been blessed to have opportunities to engage with a number of different EDR tools/frameworks at dif...
Thursday, September 23, 2021

Imposter Syndrome

›
Imposter Syndrome .  This is something many of us have experienced to one degree or another, at various times. Many have experienced, some h...
2 comments:
Sunday, September 19, 2021

Distros and RegRipper

›
Over the years, every now and then I've taken a look around to try to see where RegRipper is used. I noticed early on that it's incl...

On Writing DFIR Books, pt II

›
Part I of this series  kicked things off for us, and honestly I have no idea how long this series will be...I'm just writing the posts w...
Monday, September 06, 2021

Tips for DFIR Analysts, pt II

›
On the heels of my first post with this subject, I thought I'd continue adding tips as they came to mind... I've been engaged with ...