Pages

▼
Monday, October 09, 2023

Investigating Time Stomping

›
Some analysts may be familiar with the topic of time stomping, particularly as it applies to the NTFS file system, and is explained in great...
Tuesday, September 19, 2023

The State of Windows Digital Analysis, pt II

›
On the heels of my previous blog post on this topic , I read a report that, in a lot of ways, really highlighted some of the issues I mentio...
1 comment:
Tuesday, September 12, 2023

The State of Windows Digital Analysis

›
Something that I've seen and been concerned about for some time now is the state of digital analysis, particularly when it comes to Wind...
2 comments:
Monday, August 28, 2023

Book Review: Effective Threat Investigation for SOC Analysts

›
I recently had an opportunity to review the book, Effective Threat Investigation for SOC Analysts , by Mostafa Yahia.  Before I start off ...
Sunday, August 27, 2023

The Next Step: Integrating Yara with RegRipper, pt II

›
Okay, so we've integrated Yara into the RegRipper workflow , and created "YARR"...now what? The capability is great...at least...
Tuesday, August 22, 2023

Yet Another Glitch In The Matrix

›
It's about that time again, isn't it? It's been a while since we've had a significant (or, depending upon your perspective, ...
Sunday, August 13, 2023

Integrating Yara with RegRipper

›
A lot of writing and training within DFIR about the Registry refers to it as a database where configuration settings and information is main...
Saturday, August 12, 2023

The Next Step: Expanding RegRipper

›
I thought I'd continue The Next Step series of blog posts with something a little different. This "The Next Step" blog post i...
Monday, August 07, 2023

Ransomware Attack Timeline

›
The morning of 1 Aug, I found an article in my feed about a ransomware attack against a municipality; specifically, Montclair Township in Ne...
Wednesday, August 02, 2023

Events Ripper Updates

›
I uploaded several new updates to Events Ripper plugins in the repo recently... defender.pl - added a check for event ID 2050 records , in...
Friday, July 28, 2023

Thoughts on Tool Features, pt II

›
My previous post on this topic  addressed an apparent dichotomy (admittedly, based on a limited aperture) of thought between vendors and use...
3 comments:
Wednesday, July 26, 2023

Thoughts on Tool Features

›
Not long ago, some exchanges and conversations led me to do something I'd never done before... post a poll on LinkedIn . These conversat...
Monday, July 24, 2023

The Next Step: VHD Files and Metadata

›
Keeping with the theme from my previous blog post of building on what others have done and written about, and of assembling the pieces that...
Sunday, July 23, 2023

The Next Step

›
A lot of times, we'll run across something or read something really very profound and valuable, something that opens our eyes and makes ...