Pages

▼
Monday, January 06, 2025

Carving

›
Recovering deleted data, or "carving", is an interesting digital forensics topic; I say "interesting" because there are ...
Tuesday, December 24, 2024

UEPOTB, LNK edition

›
A while back, Jesse Kornblum published a paper titled, " Using Every Part of the Buffalo in Windows Memory Analysis ". This was, a...
Tuesday, November 26, 2024

Program Execution: The ShimCache/AmCache Myth

›
I recently saw another LinkedIn post from someone supporting and sending readers to a site that was reportedly started using the SANS DFIR ...
1 comment:
Thursday, October 31, 2024

FTSCon

›
I had the distinct honor and pleasure of speaking at the "From The Source" Conference (FTSCon) on 21 Oct, in Arlington, VA. This ...
Saturday, October 26, 2024

Artifact Tracking: Workstation Names

›
Very often in cybersecurity, we share some level of indicators of compromise (IOCs), such as IP addresses, domain names, or file names or ha...
Tuesday, October 15, 2024

Analysis Process

›
Now and again, someone will ask me, "...how do you do analysis?" or perhaps more specifically, "...how do you use RegRipper?...

Rundown

›
I ran across a fascinating post from Cyber Sundae DFIR recently that talked about the Capability Access Manager, and how with Windows 11 it...
Wednesday, October 09, 2024

Exploiting LNK Metadata

›
Anyone who's followed me for a bit knows that I'm a huge proponent of metadata, and in particular, exploiting metadata in LNK files ...
Tuesday, October 08, 2024

Shell Items

›
I ran across a Cyber5W article recently titled, Windows Shell Item Analysis . I'm always very interested in not only understanding parsi...

RegRipper Educational Materials

›
A recent LinkedIn thread led to a question regarding RegRipper educational materials, as seen in figure 1; specifically, are there any. Fi...
Monday, July 08, 2024

What is "Events Ripper"?

›
I posted to LinkedIn recently (see figure 1), sharing the value I'd continued to derive from Events Ripper , a tool I'd written lar...
Monday, June 03, 2024

The Myth of "Fileless" Malware

›
Is "fileless" malware really fileless? Now, don't get me wrong...I get what those who use this term are trying to say; that ...
5 comments: