Pages

▼
Wednesday, August 02, 2023

Events Ripper Updates

›
I uploaded several new updates to Events Ripper plugins in the repo recently... defender.pl - added a check for event ID 2050 records , in...
Friday, July 28, 2023

Thoughts on Tool Features, pt II

›
My previous post on this topic  addressed an apparent dichotomy (admittedly, based on a limited aperture) of thought between vendors and use...
3 comments:
Wednesday, July 26, 2023

Thoughts on Tool Features

›
Not long ago, some exchanges and conversations led me to do something I'd never done before... post a poll on LinkedIn . These conversat...
Monday, July 24, 2023

The Next Step: VHD Files and Metadata

›
Keeping with the theme from my previous blog post of building on what others have done and written about, and of assembling the pieces that...
Sunday, July 23, 2023

The Next Step

›
A lot of times, we'll run across something or read something really very profound and valuable, something that opens our eyes and makes ...
Friday, July 14, 2023

Events Ripper Update

›
Something I really, really like about tools like RegRipper and Events Ripper is that when I see something in the data during an investiga...
Saturday, July 08, 2023

Hiding In The Windows Event Log

›
In May 2022, Kaspersky published a write-up on a newly-discovered campaign where malware authors wrote shellcode to the Windows Event Log. ...
Wednesday, June 28, 2023

Interview Questions

›
There's been a lot of ink put toward resume recommendations and preparing for interviews over the years, and I feel like there's bee...
Monday, June 26, 2023

Validation - This Time, Tool Validation

›
I've posted previously on validation, and more recently, on validation of findings . In my recent series of posts, I specifically avoide...
1 comment:
Saturday, June 24, 2023

DFIR Core Principles

›
My copy of "Forensic Discovery" There are a lot of folks new to the cybersecurity industry, and in particular DFIR, and a lot of f...
Monday, June 19, 2023

The Need for Innovation in DFIR

›
Barely a week goes by and we see another yet post on social media that discusses knowledge sharing or "training" in cybersecurity,...
Monday, June 05, 2023

Events Ripper Update

›
Yet again, recent incidents have led to Events Ripper being updated. This time, it's an updated plugin, and a new plugin. appissue.pl ...
Thursday, June 01, 2023

Events Ripper Update

›
Working a recent incident, I came across something very unusual. I started by going back into a previous investigation run against the endpo...
Friday, May 26, 2023

Events Ripper Updates

›
I updated an Events Ripper plugin recently, and added two new ones...I tend to do this when I see something new to that I don't have to...
Tuesday, May 16, 2023

Composite Objects and Constellations

›
Okay, to start off, if you haven't seen Joe Slowik's RSA 2022 presentation , you should stop now and go watch it. Joe does a great j...

The Windows Registry

›
When it comes to analyzing and understanding the Windows Registry, where do we go, as an industry, to get the information we need? Why does ...
Friday, May 05, 2023

Events Ripper Updates

›
As you may know, I'm a pretty big proponent for documenting things that we "see" or find during investigations, and then bakin...
Thursday, April 27, 2023

Program Execution

›
By now, I hope you've had a chance to read and consider the posts I've written discussing the need for  validation of findings ( thi...