Collaborate Disseminate
While I worked for one company, I did a lot of public speaking on the value of threat hunting. During these events, I met a lot of folks who were interested to learn what “threat hunting” was, and how it could be of value to them.I live in a very rural… Continue reading Threat Hunting, IRL
Over the years, I’ve seen DFIR referred to in terms of special operations forces. I’ve seen incident response teams referred to as “Cyber SEALs”, as well as via various other terms. However, when you really look at, incident response is much more akin … Continue reading Tips for DFIR Analysts, pt. V
Context is king, it makes all the difference. You may see something run in EDR telemetry, or in logs, but the context of when it ran in relation to other activities is often critical. Did it occur immediately following a system reboot or a user login? … Continue reading Tips for DFIR Analysts, pt IV
I’ve posted on the topic of data exfiltration before (here, etc.) but often it’s a good idea to revisit the topic. After all, it was almost two years ago that we saw the first instance of ransomware threat actors stating publicly that they’d exfiltrate… Continue reading Data Exfiltration, Revisited
Learn to think critically. Don’t take what someone says as gospel, just because they say it. Support findings with data, and clearly communicate the value or significance of something.Be sure to validate your findings, and never rest your findings on a… Continue reading Tips for DFIR Analysts, pt III
During my time in the industry, I’ve been blessed to have opportunities to engage with a number of different EDR tools/frameworks at different levels. Mike Tanji offered me a look at Carbon Black before carbonblack.com existed, while it still used an o… Continue reading EDR Bypasses
Imposter Syndrome. This is something many of us have experienced to one degree or another, at various times. Many have experienced, some have overcome it, others may not be able to and wonder why.HealthLine tells us, “Imposter feelings represent a… Continue reading Imposter Syndrome
Over the years, every now and then I’ve taken a look around to try to see where RegRipper is used. I noticed early on that it’s included in several security-oriented Linux distros. So, I took the opportunity to compile some of the links I’d found, and … Continue reading Distros and RegRipper
Part I of this series kicked things off for us, and honestly I have no idea how long this series will be…I’m just writing the posts without a specific plan or outline for the series. In this case, I opted to take an organic approach, and wanted … Continue reading On Writing DFIR Books, pt II
On the heels of my first post with this subject, I thought I’d continue adding tips as they came to mind…I’ve been engaged with EDR frameworks for some time now. I first became aware of Carbon Black before it was “version 1.0”, and before “carbonblac… Continue reading Tips for DFIR Analysts, pt II