Collaborate Disseminate
Peter Parker might not be a mastermind cryptocurrency criminal, but the name Spiderman is quickly becoming more associated with the mining landscape. ReasonLabs, a leading provider of cybersecurity prevention and detection software, recently discovere… Continue reading ‘Spider-Man: No Way Home’ Pirated Downloads Contain Crypto-Mining Malware
Editing and FeedbackWhen it comes to writing books, having someone can trust to give you honest, thoughtful, insightful feedback is a huge plus. It can do a lot to boost your confidence and help you deliver a product that you’re proud of.When I first s… Continue reading On Writing DFIR Books, pt III
Chris Sanders tweeted out an interesting pair of questions recently, and the simple fact is that for me to fully answer the question, the tweet thread would be just too extensive. The questions were:What are the most common reasons you go looking in th… Continue reading Reasons to go looking in the Registry
Context & Finding PersistenceI was looking into an unusual mechanism for launching applications recently, and that research brought back a recurring issue I’ve seen time and again in the industry, specifically pivoting from one data point to anothe… Continue reading Tips for DFIR Analysts, pt VI
While I worked for one company, I did a lot of public speaking on the value of threat hunting. During these events, I met a lot of folks who were interested to learn what “threat hunting” was, and how it could be of value to them.I live in a very rural… Continue reading Threat Hunting, IRL
Over the years, I’ve seen DFIR referred to in terms of special operations forces. I’ve seen incident response teams referred to as “Cyber SEALs”, as well as via various other terms. However, when you really look at, incident response is much more akin … Continue reading Tips for DFIR Analysts, pt. V
Context is king, it makes all the difference. You may see something run in EDR telemetry, or in logs, but the context of when it ran in relation to other activities is often critical. Did it occur immediately following a system reboot or a user login? … Continue reading Tips for DFIR Analysts, pt IV
I’ve posted on the topic of data exfiltration before (here, etc.) but often it’s a good idea to revisit the topic. After all, it was almost two years ago that we saw the first instance of ransomware threat actors stating publicly that they’d exfiltrate… Continue reading Data Exfiltration, Revisited
Learn to think critically. Don’t take what someone says as gospel, just because they say it. Support findings with data, and clearly communicate the value or significance of something.Be sure to validate your findings, and never rest your findings on a… Continue reading Tips for DFIR Analysts, pt III
During my time in the industry, I’ve been blessed to have opportunities to engage with a number of different EDR tools/frameworks at different levels. Mike Tanji offered me a look at Carbon Black before carbonblack.com existed, while it still used an o… Continue reading EDR Bypasses