Pages

▼
Friday, May 26, 2023

Events Ripper Updates

›
I updated an Events Ripper plugin recently, and added two new ones...I tend to do this when I see something new to that I don't have to...
Tuesday, May 16, 2023

Composite Objects and Constellations

›
Okay, to start off, if you haven't seen Joe Slowik's RSA 2022 presentation , you should stop now and go watch it. Joe does a great j...

The Windows Registry

›
When it comes to analyzing and understanding the Windows Registry, where do we go, as an industry, to get the information we need? Why does ...
Friday, May 05, 2023

Events Ripper Updates

›
As you may know, I'm a pretty big proponent for documenting things that we "see" or find during investigations, and then bakin...
Thursday, April 27, 2023

Program Execution

›
By now, I hope you've had a chance to read and consider the posts I've written discussing the need for  validation of findings ( thi...
Monday, April 24, 2023

New Events Ripper Plugins

›
I recently released four new Events Ripper plugins , mssql.pl , scm7000.pl , scm7024.pl and  apppopup26.pl .  The mssql.pl plugin primarily...

On Validation, pt III

›
From the first two articles ( here , and here ) on this topic arises the obvious question...so what? Not validating findings has worked wel...
4 comments:
Sunday, April 16, 2023

On Validation, pt II

›
My first post on this topic didn't result in a great deal of engagement, but that's okay. I wrote the first post with part II alrea...
Friday, April 07, 2023

Deriving Value From Open Reporting

›
There's a good bit of open reporting available online these days, including (but not limited to) the annual reports that tend to be publ...
Wednesday, April 05, 2023

Unraveling Rorschach

›
Checkpoint recently shared a write-up on some newly-discovered ransomware dubbed, "Rorschach". The write-up was pretty interestin...
Monday, April 03, 2023

On Validation

›
I've struggled with the concept of "validation" for some time; not the concept in general, but as it applies specifically to S...
4 comments:
Saturday, March 25, 2023

Password Hash Leakage

›
If you've been in the security community for even a brief time, or you've taking training associated with a certification in this fi...

The "Why" Behind Tactics

›
Very often we'll see mention in open reporting of a threat actor's tactics, be they "new" or just what's being observe...
Thursday, March 16, 2023

Threat Actors Changing Tactics

›
I've been reading a bit lately on social media about how cyber security is "hard" and it's "expensive", and abou...
3 comments:
Sunday, March 12, 2023

On Using Tools

›
I've written about using tools before in this blog, but there are times when something comes up that provokes a desire to revisit a top...
2 comments: