Collaborate Disseminate
I recently posted to LinkedIn, asking my network for their input regarding the value proposition of RegRipper; specifically, how is RegRipper v3.0 of “value” to them, how does it enhance their work? I did this because I really wanted to get the perspec… Continue reading RegRipper Value Proposition
After reading some of the various open reports regarding how malware or threat actors were “using” the Registry, manipulating it to meet their needs, I wanted to take a look and see what the effects or impacts of these actions might “look like” from a … Continue reading Testing Registry Modification Scenarios
During IR engagements, like many other analysts, I’ve seen different means of data exfiltration. During one engagement, the customer stated that they’d “…shut off all of our FTP servers…”, but apparently “all” meant something different to them, bec… Continue reading Data Collection
Not long ago, I made a brief mention of Events Ripper, a proof-of-concept tool I wrote to quickly provide situational awareness and pivot points for analysts who were already on the road to developing a timeline. The idea behind the tool is that artifa… Continue reading Events Ripper
I received a job description from a recruiter recently, along with the request that if I knew anyone who fit the bill and was interested, could I please forward the job description to them. The recruiter was looking for someone at an entry-level, with … Continue reading We Need Cybersecurity Mentors
For this post, I’ll throw out a bunch of little snippets, or “post-lets”, covering a variety of DFIR topics rather than one big post that covers one topic.What’s Old Is New AgainDuring Feb, 2016, Mari published a fascinating blog post regarding the VBA… Continue reading Post Compilation
Every now and again, I have a need (re: “opportunity”) to compile a list of recorded speaking events. The reasons vary…there’s a particular message in one or more of the recordings, or someone wants to see/hear what was said, or it’s more about showi… Continue reading Speaking Engagements
I had the opportunity to speak at the recent ResponderCon, put on by Brian Carrier of BasisTech. I’ll start out by saying that I really enjoyed attending an in-person event after 2 1/2 yrs of virtual events, and that Brian’s idea to do something a bit … Continue reading ResponderCon Followup
Not long ago, Florian Roth shared some fascinating thoughts via his post, The Bicycle of the Forensic Analyst, in which he discusses increases in efficiency in the forensic review process. I say “review” here, because “analysis” is a term that is often… Continue reading Deconstructing Florian’s Bicycle
Not long ago, I posted about When Windows Lies, and that post really wasn’t so much about Windows “lying”, per se, as it was about challenging analyst assumptions about artifacts, and recognizing misconceptions. Along the same lines, I’ve also posted a… Continue reading AmCache Revisited