Pages

▼
Sunday, December 31, 2023

2023 Wrap-up

›
Another trip around the sun is in the books. Looking back over the year, I thought I'd tie a bow on some of the things I'd done, and...
Monday, December 18, 2023

Round Up

›
MSSQL is still a thing TheDFIRReport recently posted an article regarding BlueSky ransomware being deployed following MSSQL being brute for...
Monday, December 11, 2023

...and the question is...

›
I received an interesting question via LinkedIn not long ago, but before we dive into the question and the response... If you've followe...
Tuesday, November 28, 2023

Roll-up

›
One of the things I love about the industry is that it's like fashion...given enough time, the style that came and went comes back aroun...
Friday, November 10, 2023

Roll-up

›
I don't like checklists in #DFIR.  Rather, I don't like how checklists are used in #DFIR. Too often, they're used as a replaceme...
Monday, October 09, 2023

Investigating Time Stomping

›
Some analysts may be familiar with the topic of time stomping, particularly as it applies to the NTFS file system, and is explained in great...
Tuesday, September 19, 2023

The State of Windows Digital Analysis, pt II

›
On the heels of my previous blog post on this topic , I read a report that, in a lot of ways, really highlighted some of the issues I mentio...
1 comment:
Tuesday, September 12, 2023

The State of Windows Digital Analysis

›
Something that I've seen and been concerned about for some time now is the state of digital analysis, particularly when it comes to Wind...
2 comments:
Monday, August 28, 2023

Book Review: Effective Threat Investigation for SOC Analysts

›
I recently had an opportunity to review the book, Effective Threat Investigation for SOC Analysts , by Mostafa Yahia.  Before I start off ...
Sunday, August 27, 2023

The Next Step: Integrating Yara with RegRipper, pt II

›
Okay, so we've integrated Yara into the RegRipper workflow , and created "YARR"...now what? The capability is great...at least...
Tuesday, August 22, 2023

Yet Another Glitch In The Matrix

›
It's about that time again, isn't it? It's been a while since we've had a significant (or, depending upon your perspective, ...
Sunday, August 13, 2023

Integrating Yara with RegRipper

›
A lot of writing and training within DFIR about the Registry refers to it as a database where configuration settings and information is main...
Saturday, August 12, 2023

The Next Step: Expanding RegRipper

›
I thought I'd continue The Next Step series of blog posts with something a little different. This "The Next Step" blog post i...
Monday, August 07, 2023

Ransomware Attack Timeline

›
The morning of 1 Aug, I found an article in my feed about a ransomware attack against a municipality; specifically, Montclair Township in Ne...