Pages

▼
Sunday, July 31, 2022

Virtual Images for Testing

›
Many within the DFIR community make use of virtual systems for testing...for detonating malware, trying things within a "safe", is...

EDR Blindness, pt II

›
As a follow-on to my earlier blog post , I've seen a few more posts and comments regarding EDR 'bypass' and blinding/avoiding ED...
Tuesday, July 26, 2022

Rods and Cones, and EDR "blindness"

›
I ran across an interesting post recently regarding blinding EDR on Windows systems, which describes four general techniques for avoiding E...
Sunday, July 24, 2022

History Repeats Itself

›
It's said that those who do not study history are doomed to repeat it. I'd suggest that the adage should be extended to, "those...
Saturday, July 23, 2022

Turning Open Reporting Into Detections

›
I saw this tweet from Ankit recently, and as soon as I read through it, I thought I was watching "The Matrix" again. Instead of s...
Tuesday, July 19, 2022

Fully Exploiting Data Sources

›
Very often, we view data sources as somewhat one dimensional, and don't think about how we can really get value from that data source. W...
Sunday, July 17, 2022

StartupApproved\Run, pt II

›
On the heels of my last blog post on this topic , I had a couple of thoughts and insights that I wanted to research a bit, and then address...
3 comments:
Saturday, July 09, 2022

Does "Autostart" Really Mean "Autostart"?

›
Most DFIR and SOC analysts are familiar with the Run keys as autostart locations within the Windows Registry: [HKLM|HKCU]\Software\Microsoft...
1 comment:
Friday, July 01, 2022

Distros and RegRipper, pt deux

›
Now and again I pop my head up and take a look around to see where RegRipper has been, and is being, used. My last blog post on this topic ...
Thursday, May 26, 2022

USB Device Redux, with Timelines

›
If you ask DFIR analysts, " What is best in life? ", the answer you should hear is, "...creating timelines!" After all,...
Tuesday, May 17, 2022

USB Devices Redux

›
Back in 2005, Cory Altheide and I published the first paper on tracking USB storage devices across Windows systems; at the time, the focus ...
4 comments:
Friday, May 13, 2022

Understanding Data Sources and File Formats

›
Following on the heels of my previous post regarding file formats and sharing the link to the post on LinkedIn , I had some additional thou...