Pages

▼
Sunday, March 27, 2022

Scheduled Tasks and Batteries

›
Krzysztof shared another blog post recently, this one that addresses the battery use and the battery level of a system, and how it applies...
Thursday, March 24, 2022

Windows Event Log Evasion Review

›
Before I kick this blog post off, I'd like to thank Lina L for her excellent work in developing and sharing her work, both on Twitter ,...
3 comments:
Sunday, March 06, 2022

The (Mis)Use of Artifact Categories, pt II

›
My previous post on this topic  presented my thoughts on how the concept of "artifact categories" were being misused. My engagemen...

DFIR Reporting

›
A request that's been pretty consistent within the industry over time has had to do with reporting. I'd see a request, some response...
Monday, February 28, 2022

The (Mis)Use of Artifact Categories

›
Very often in DFIR, we categorize artifacts in an easy-to-understand and easy-to-digest manner, as using or relying on these categories ofte...
Friday, February 11, 2022

LNK Files, Again

›
What, again?!?! I know, right?!? Not long ago, I read this fascinating article from Joe Helle that discussed malicious uses for Windows sh...
Sunday, January 23, 2022

The Threat Landscape and Attribution

›
Over the years, changes in the threat landscape have made attribution more difficult. Attribution has always been challenging, but has been ...
Wednesday, January 19, 2022

How Do You Know What "Bad" Looks Like?

›
From the time I started in DFIR, one question was always on the forefront of incident responder's minds... how do you know what "ba...
Monday, January 17, 2022

Registry Analysis - The "Why"

›
Why is Registry analysis important? The Windows Registry, in part, controls a good bit of the functionality of a Windows system. As such, Re...
3 comments:
Wednesday, December 22, 2021

On Writing DFIR Books, pt III

›
Editing and Feedback When it comes to writing books, having someone can trust to give you honest, thoughtful, insightful feedback is a huge ...
Saturday, December 18, 2021

Reasons to go looking in the Registry

›
Chris Sanders tweeted out an interesting pair of questions recently, and the simple fact is that for me to fully answer the question, the t...
Tuesday, December 14, 2021

Tips for DFIR Analysts, pt VI

›
Context & Finding Persistence I was looking into an unusual mechanism for launching applications recently, and that research brought bac...
Thursday, November 25, 2021

Threat Hunting, IRL

›
While I worked for one company, I did a lot of public speaking on the value of threat hunting. During these events, I met a lot of folks who...