Pages

▼
Sunday, February 26, 2023

Devices

›
This interview regarding one of the victims of the University of Idaho killings having a Bluetooth speaker in her room brings up a very im...
Saturday, February 25, 2023

Why Write?

›
I shared yet another post on writing recently; I say "yet another" because I've published blog posts on the topic of "wr...
Monday, February 20, 2023

WEVTX Event IDs

›
Now and again, we see online content that moves the community forward, a step or several steps. One such article appeared on Medium recently...
Monday, February 13, 2023

Training and CTFs

›
The military has a couple of adages...one, "you fight like you train", and another being, "the more you sweat in peace, the l...
Monday, February 06, 2023

Why Lists?

›
So much of what we see in cybersecurity, in SOC, DFIR, red teaming/ethical hacking/pen testing, seems to be predicated on lists. Lists of to...
Sunday, February 05, 2023

Validating Tools

›
Many times, in the course of our work as analysts (SOC, DFIR, etc.), we run tools...and that's it. But do we often stop to think about w...
Monday, January 30, 2023

Soft Skills: Writing

›
Writing.  Like math in middle school, this is one of those subjects that we pushed back on, telling ourselves, "I'll never have to ...
2 comments:
Sunday, January 15, 2023

Wi-Fi Geolocation, Then and Now

›
I've always been fascinated by the information maintained in the Windows Registry. But in order to understand this, to really get a view...
Saturday, December 31, 2022

Persistence and LOLBins

›
Grzegorz/@0gtweet tweeted something recently that I thought was fascinating, suggesting that a Registry modification might be considered an...

Keeping Grounded

›
As 2022 comes to a close, I reflect back over the past year, and the previous years that have gone before. I know we find it fascinating to ...
Sunday, December 25, 2022

Why I love RegRipper

›
Yes, yes, I know...you're probably thinking, "you wrote it, dude", and while that's true, that's not the reason why I ...
2 comments:
Monday, November 28, 2022

Post Compilation

›
Investigating Windows Systems It's the time of year again when folks are looking for stocking stuffers for the DFIR nerd in their lives,...
Sunday, November 27, 2022

Challenge 7 Write-up

›
Dr. Ali Hadi recently posted another challenge image , this one (#7) being a lot closer to a real-world challenge than a lot of the CTFs I...
Sunday, November 20, 2022

Thoughts on Teaching Digital Forensics

›
When I first started writing books, my "recipe" for how to present the information followed the same structure I saw in other book...
Monday, November 14, 2022

RegRipper Value Proposition

›
I recently posted to LinkedIn , asking my network for their input regarding the value proposition of RegRipper; specifically, how is RegRipp...
Monday, October 31, 2022

Testing Registry Modification Scenarios

›
After reading some of the various open reports regarding how malware or threat actors were "using" the Registry, manipulating it t...