Collaborate Disseminate
If someone asked me to name the biggest shortcoming in DFIR, and in cybersecurity, in general, I’d have to say documentation.We miss a lot of value because activity and analysis goes undocumented, and it is lost. Without documentation clearly delineati… Continue reading The Value of Documentation
Something I’ve seen consistently, from the very beginning when I first brushed up against this business of “digital forensics”, is the default focus on, “…this is how you analyze this artifact…”, and rarely extending beyond that. I’m gui… Continue reading Investigations and Analysis
I didn’t start out in threat intel. I didn’t start my career in cybersecurity in DF/IR work. I started doing vulnerability assessments using commercial tools (ISS’s Internet Scanner) and well as freely-available tools (i.e., ToneLoc and THCScan, f… Continue reading Burn Out, Or Fade Away
I ran across this Ctrl-Alt-Intel blog post today, which discusses RustGate v2, and noticed that for all of what was addressed in the blog, there wasn’t a great deal of content regarding the delivery method, the LNK file itself. Figure 1 illustrat… Continue reading LNK Metadata
I had an opportunity a bit ago to engage with three other folks within the industry, all at the same time, and all of us from varied backgrounds. We had some similarities in our backgrounds, and some overlaps or near-misses in our experiences and emplo… Continue reading Knowledge Retention & Sharing in DF/IR
Many times within the industry, we hear things stated repeatedly, or with authority, or both, and simply accept them as fact, as being true. However, a lot of times, these statements of “truth” are based on the aperture and perspective of the individua… Continue reading True Lies
I recently ran across a comment from a SOC manager on social media that said, “Finding initial access is difficult.”I thought about it for a moment, and had to ask, “why is that?”For context, I transitioned from military service in 1997, and shortly th… Continue reading Finding Initial Access
There’s a good bit of file analysis that goes into CTI reports, including (but not limited to) malware analysis. But for some reason, not all files appear to be worthy of parsing and analysis. We also tend to see in-depth descriptions of the value of L… Continue reading LNK Files in CTI
I’m just going to say it.IOCs are not “threat intel”. Lists of IP addresses and domain names, without context, are data points and information, not “intel”. Threat intel is based on patterns developed from the accumulation/aggregation of data.In 2… Continue reading Rigor in Threat Intel
I’m just going to say it.IOCs are not “threat intel”. Lists of IP addresses and domain names, without context, are data points and information, not “intel”. Threat intel is based on patterns developed from the accumulation/aggregation of data.In 2… Continue reading Rigor in Threat Intel