Collaborate Disseminate
Grzegorz/@0gtweet tweeted something recently that I thought was fascinating, suggesting that a Registry modification might be considered an LOLBin. What he shared was pretty interesting, so I tried it out.First, the Registry modification:reg add “HKLM\… Continue reading Persistence and LOLBins
As 2022 comes to a close, I reflect back over the past year, and the previous years that have gone before. I know we find it fascinating to hear “experts” make predictions for the future, but I tend to believe that there’s more value in reflecting on a… Continue reading Keeping Grounded
Yes, yes, I know…you’re probably thinking, “you wrote it, dude”, and while that’s true, that’s not the reason why I really love RegRipper. Yes, it’s my “baby”, but there’s so much more to it than that. For me, it’s about flexibility and utility. At t… Continue reading Why I love RegRipper
Investigating Windows SystemsIt’s the time of year again when folks are looking for stocking stuffers for the DFIR nerd in their lives, and my recommendation is a copy of Investigating Windows Systems! The form factor for the book makes it a great stoc… Continue reading Post Compilation
Dr. Ali Hadi recently posted another challenge image, this one (#7) being a lot closer to a real-world challenge than a lot of the CTFs I’ve seen over the years. What I mean by that is that in the 22+ years I’ve done DFIR work, I’ve never had a custome… Continue reading Challenge 7 Write-up
When I first started writing books, my “recipe” for how to present the information followed the same structure I saw in other books at the time. While I was writing books to provide content along the lines of what I wanted to see, essentially filling i… Continue reading Thoughts on Teaching Digital Forensics
I recently posted to LinkedIn, asking my network for their input regarding the value proposition of RegRipper; specifically, how is RegRipper v3.0 of “value” to them, how does it enhance their work? I did this because I really wanted to get the perspec… Continue reading RegRipper Value Proposition
After reading some of the various open reports regarding how malware or threat actors were “using” the Registry, manipulating it to meet their needs, I wanted to take a look and see what the effects or impacts of these actions might “look like” from a … Continue reading Testing Registry Modification Scenarios
During IR engagements, like many other analysts, I’ve seen different means of data exfiltration. During one engagement, the customer stated that they’d “…shut off all of our FTP servers…”, but apparently “all” meant something different to them, bec… Continue reading Data Collection
Not long ago, I made a brief mention of Events Ripper, a proof-of-concept tool I wrote to quickly provide situational awareness and pivot points for analysts who were already on the road to developing a timeline. The idea behind the tool is that artifa… Continue reading Events Ripper