Collaborate Disseminate
There’s been a lot of ink put toward resume recommendations and preparing for interviews over the years, and I feel like there’s been even more lately, given the number of folks looking to transition to one of the cybersecurity fields, as well as tech … Continue reading Interview Questions
I’ve posted previously on validation, and more recently, on validation of findings. In my recent series of posts, I specifically avoided the top of tool validation, because while tool validation predicates the validation of findings, and there is some … Continue reading Validation – This Time, Tool Validation
My copy of “Forensic Discovery”There are a lot of folks new to the cybersecurity industry, and in particular DFIR, and a lot of folks considering getting into the field. As such, I thought it might be useful to share my view of the core, foundational p… Continue reading DFIR Core Principles
Barely a week goes by and we see another yet post on social media that discusses knowledge sharing or “training” in cybersecurity, and in particular, DFIR and Windows forensic analysis. However, many times, these posts aren’t “new”, per se, but instead… Continue reading The Need for Innovation in DFIR
Yet again, recent incidents have led to Events Ripper being updated. This time, it’s an updated plugin, and a new plugin.appissue.pl – I updated this plugin based on Josh’s finding and Tweet; I can’t say that I’ve ever seen this event before, but when … Continue reading Events Ripper Update
Working a recent incident, I came across something very unusual. I started by going back into a previous investigation run against the endpoint that had been conducted a month ago, and extracting the WEVTX files collected as part of that investigation…. Continue reading Events Ripper Update
I updated an Events Ripper plugin recently, and added two new ones…I tend to do this when I see something new to that I don’t have to remember to run a command, check a box on a checklist, or take some other step. If I have to do any of these, I’m no… Continue reading Events Ripper Updates
Okay, to start off, if you haven’t seen Joe Slowik’s RSA 2022 presentation, you should stop now and go watch it. Joe does a great job of explaining and demonstrating why IOCs are truly composite objects, that there’s much more to an IP address than jus… Continue reading Composite Objects and Constellations
When it comes to analyzing and understanding the Windows Registry, where do we go, as an industry, to get the information we need?Why does this even matter?Well, an understanding of the Registry can provide insight into the target (admin, malicious ins… Continue reading The Windows Registry
As you may know, I’m a pretty big proponent for documenting things that we “see” or find during investigations, and then baking those things back into the parsing and decoration process, as a means of automating and retaining corporate knowledge. This … Continue reading Events Ripper Updates