Pages

▼
Friday, April 29, 2022

Root Cause Analysis

›
One of the challenges within DFIR, particularly as we've moved to an enterprise approach by leveraging EDR telemetry, is the root cause ...
Monday, April 25, 2022

File Formats

›
Having an understanding of file formats is an important factor in DFIR work. In particular, analysts should understand what a proper file us...
Tuesday, April 19, 2022

LNK (Ab)use

›
I've discussed LNK files a number of times in this blog, and to be honest, I really don't think that this is a subject that gets th...
Wednesday, April 13, 2022

Digging Into Open Reporting

›
As many readers of this blog are aware, I often find great value in open reporting, but that I also see the value in taking that open report...
Friday, April 08, 2022

Timestomping Registry Keys

›
If you're worked in DFIR or threat intel for any amount of time, you've likely either seen or heard how threat actors modify systems...
Sunday, March 27, 2022

Scheduled Tasks and Batteries

›
Krzysztof shared another blog post recently, this one that addresses the battery use and the battery level of a system, and how it applies...
Thursday, March 24, 2022

Windows Event Log Evasion Review

›
Before I kick this blog post off, I'd like to thank Lina L for her excellent work in developing and sharing her work, both on Twitter ,...
3 comments:
Sunday, March 06, 2022

The (Mis)Use of Artifact Categories, pt II

›
My previous post on this topic  presented my thoughts on how the concept of "artifact categories" were being misused. My engagemen...

DFIR Reporting

›
A request that's been pretty consistent within the industry over time has had to do with reporting. I'd see a request, some response...
Monday, February 28, 2022

The (Mis)Use of Artifact Categories

›
Very often in DFIR, we categorize artifacts in an easy-to-understand and easy-to-digest manner, as using or relying on these categories ofte...
Friday, February 11, 2022

LNK Files, Again

›
What, again?!?! I know, right?!? Not long ago, I read this fascinating article from Joe Helle that discussed malicious uses for Windows sh...
Sunday, January 23, 2022

The Threat Landscape and Attribution

›
Over the years, changes in the threat landscape have made attribution more difficult. Attribution has always been challenging, but has been ...
Wednesday, January 19, 2022

How Do You Know What "Bad" Looks Like?

›
From the time I started in DFIR, one question was always on the forefront of incident responder's minds... how do you know what "ba...
Monday, January 17, 2022

Registry Analysis - The "Why"

›
Why is Registry analysis important? The Windows Registry, in part, controls a good bit of the functionality of a Windows system. As such, Re...
3 comments: