Collaborate Disseminate
I ran across an interesting post recently regarding blinding EDR on Windows systems, which describes four general techniques for avoiding EDR monitoring. Looking at the techniques, I’ve seen several of these techniques in use on actual, real world inci… Continue reading Rods and Cones, and EDR "blindness"
It’s said that those who do not study history are doomed to repeat it. I’d suggest that the adage should be extended to, “those who do not study history and learn from her lessons are doomed to repeat it.”My engagement with technology began at an early… Continue reading History Repeats Itself
I saw this tweet from Ankit recently, and as soon as I read through it, I thought I was watching “The Matrix” again. Instead of seeing the “blonde, brunette, redhead” that Cypher saw, I was seeing actionable detection opportunities and pivot points. Ho… Continue reading Turning Open Reporting Into Detections
Very often, we view data sources as somewhat one dimensional, and don’t think about how we can really get value from that data source. We’re usually working on a case, just that investigation that’s in front of us, and we’re so “heads down” that we may… Continue reading Fully Exploiting Data Sources
On the heels of my last blog post on this topic, I had a couple of thoughts and insights that I wanted to research a bit, and then address. I wanted to take a look at ways that the StartupApproved\Run key might be impacted, so I started by grabbing the… Continue reading StartupApproved\Run, pt II
Most DFIR and SOC analysts are familiar with the Run keys as autostart locations within the Windows Registry:[HKLM|HKCU]\Software\Microsoft\Windows\CurrentVersion\RunValues beneath these keys are automatically run asynchronously upon system start and u… Continue reading Does "Autostart" Really Mean "Autostart"?
Now and again I pop my head up and take a look around to see where RegRipper has been, and is being, used. My last blog post on this topic had quite a few listings, but sometimes changing the search terms reveals something new, or someone else has deci… Continue reading Distros and RegRipper, pt deux
If you ask DFIR analysts, “What is best in life?”, the answer you should hear is, “…creating timelines!” After all, industry luminaries such as Andrew said, “Time is the most important thing in life, and timelines are one of the most useful tools for… Continue reading USB Device Redux, with Timelines
Back in 2005, Cory Altheide and I published the first paper on tracking USB storage devices across Windows systems; at the time, the focus was Windows XP. A lot has happened since then…I know, that’s an understatement…as the Windows platform has de… Continue reading USB Devices Redux
Following on the heels of my previous post regarding file formats and sharing the link to the post on LinkedIn, I had some additional thoughts that would benefit greatly from not blasting those thoughts out as comments to the original post, but instead… Continue reading Understanding Data Sources and File Formats