Collaborate Disseminate
It’s great when a plan, or a puzzle, comes together, isn’t it? I’m not just channeling my inner Hannibal Smith…I’m talking about bringing various pieces or elements together to build a cohesive, clear picture, connecting the dots into a coh… Continue reading Putting It All Together
Not long ago, I posted regarding how LNK files can be (ab)used; the post refers to LNK file metadata, and how, if the LNK file is sent by the threat actor, that metadata can be used to learn about the threat actor’s environment. I first saw this mentio… Continue reading Changes In The Use Of LNK Files
One of the challenges within DFIR, particularly as we’ve moved to an enterprise approach by leveraging EDR telemetry, is the root cause analysis, or “RCA”. In short, the challenge is observing malicious activity and determining the root cause; the chal… Continue reading Root Cause Analysis
Having an understanding of file formats is an important factor in DFIR work. In particular, analysts should understand what a proper file using a particular format should look like, so that they can see when something is amiss, or when the file itself … Continue reading File Formats
I’ve discussed LNK files a number of times in this blog, and to be honest, I really don’t think that this is a subject that gets the attention it deserves. In my experience, and I humbly bow to collection bias here, LNK files are not as well understood… Continue reading LNK (Ab)use
As many readers of this blog are aware, I often find great value in open reporting, but that I also see the value in taking that open reporting a step (or three) further beyond where it exists now. In more than a few instances, something extra can be p… Continue reading Digging Into Open Reporting
If you’re worked in DFIR or threat intel for any amount of time, you’ve likely either seen or heard how threat actors modify systems to meet their own needs, configuring systems to provide data or hide their activities, as they make their way through a… Continue reading Timestomping Registry Keys
Krzysztof shared another blog post recently, this one that addresses the battery use and the battery level of a system, and how it applies to an investigation.At first thought, I’m sure a lot of you are asking, “wait…what?”, but think about it for a … Continue reading Scheduled Tasks and Batteries
Before I kick this blog post off, I’d like to thank Lina L for her excellent work in developing and sharing her work, both on Twitter, as well as in a blog post. Both are thoughtful, cogent, and articulate.In her blog post, Lina references detection te… Continue reading Windows Event Log Evasion Review
My previous post on this topic presented my thoughts on how the concept of “artifact categories” were being misused.My engagement with artifact categories goes back to 2013, when Corey Harrell implemented his thoughts on categories via auto_rip. I… Continue reading The (Mis)Use of Artifact Categories, pt II