Pages

▼
Tuesday, September 20, 2022

ResponderCon Followup

›
I had the opportunity to speak at the recent ResponderCon , put on by Brian Carrier of BasisTech . I'll start out by saying that I real...
Monday, September 19, 2022

Deconstructing Florian's Bicycle

›
Not long ago, Florian Roth shared some fascinating thoughts via his post, The Bicycle of the Forensic Analyst , in which he discusses incre...
Saturday, September 10, 2022

AmCache Revisited

›
Not long ago, I posted about When Windows Lies , and that post really wasn't so much about Windows "lying", per se, as it was ...
Saturday, September 03, 2022

LNK Builders

›
I've blogged a bit...okay, a LOT...over the years on the topic of parsing LNK files, but a subject I really haven't touched on is LN...

Analysis: Situational Awareness + Timelines

›
I've talked and written about timelines as an analysis process for some time, in both this blog and in my books, because I've seen ...
4 comments:
Saturday, August 27, 2022

When Windows Lies

›
"When Windows Lies"...what does that really mean?  Mari had a fascinating blog post on this topic some years ago; she talked a...
Wednesday, August 24, 2022

Kudos and Recognition

›
During my time in the industry, I've seen a couple of interesting aspects of "information sharing". One is that not many like ...
Saturday, August 13, 2022

Who "Owns" Your Infrastructure?

›
That's a good question. You go into work every day, sit down at your desk, log in...but who actually "owns" the systems and ne...
Wednesday, August 10, 2022

Researching the Windows Registry

›
The Windows Registry is a magical place that I love to research because there's always something new and fun to find, and apply to detec...
Monday, August 08, 2022

An Attacker's Perspective

›
Something I've thought about quite often during my time in DFIR is the threat actor's perspective...what is the attacker seeing and ...
Sunday, July 31, 2022

Virtual Images for Testing

›
Many within the DFIR community make use of virtual systems for testing...for detonating malware, trying things within a "safe", is...

EDR Blindness, pt II

›
As a follow-on to my earlier blog post , I've seen a few more posts and comments regarding EDR 'bypass' and blinding/avoiding ED...
Tuesday, July 26, 2022

Rods and Cones, and EDR "blindness"

›
I ran across an interesting post recently regarding blinding EDR on Windows systems, which describes four general techniques for avoiding E...
Sunday, July 24, 2022

History Repeats Itself

›
It's said that those who do not study history are doomed to repeat it. I'd suggest that the adage should be extended to, "those...
Saturday, July 23, 2022

Turning Open Reporting Into Detections

›
I saw this tweet from Ankit recently, and as soon as I read through it, I thought I was watching "The Matrix" again. Instead of s...
Tuesday, July 19, 2022

Fully Exploiting Data Sources

›
Very often, we view data sources as somewhat one dimensional, and don't think about how we can really get value from that data source. W...
Sunday, July 17, 2022

StartupApproved\Run, pt II

›
On the heels of my last blog post on this topic , I had a couple of thoughts and insights that I wanted to research a bit, and then address...
3 comments: