Author Archives: Unknown

One of the fascinating aspects of Windows systems, from a DF/IR perspective, for me has been the clipboard. Notice I said, “one of”, rather than “the”…that’s because there are a lot of fascinating aspects of Windows systems when it comes to DF/IR wor… Continue reading What’s on your clipboard?→

Sometimes I’ll get questions via different routes…webinars or podcasts, via social media, DM, or even email. Getting questions is good, because it keeps me aware that I’m in somewhat of a bubble, given the work I do and the environment in which I do … Continue reading Questions I’ve Been Asked→

This started out as a bit of an end-of-the-year grab bag of posts, but I don’t like simply linking to things, dropping links with no explanation as to why; instead, I’d rather share the why behind what I found interesting about the post or ar… Continue reading Grab Bag→

I ran across a LinkedIn post the other day that  mentioned using Windows Defender Support Logs (actually, I think the post referred to them as “diagnostic” logs). These logs are found in the following folder:C:\ProgramData\Microsoft\Windows Defend… Continue reading Windows Defender Support Logs→

I received a question recently, one I receive every now and again, asking if there are any updates to an open source tool I created a while back, called “RegRipper”. This time, the question came in this way:Is there any update on reg tool?After a … Continue reading Question on Open Source Tools→

I’m not a fan of many podcasts. I do like a conversational style, and there are some podcasts that I listen to, albeit not on a regular basis, and not for technical content. They’re mostly about either “easter eggs” in Marvel or DC movies, or the … Continue reading Perspectives on Cybersecurity→

Every now and then, I get contacted by someone who tells me that they used the open source tools I’ve released in either a college course they took, or in a course provided by one of the many training vendors in the industry. I even once responded… Continue reading Releasing Open Source Tools to the Community→

I was reading a pretty interesting write-up from Seqrite regarding, in part, the use of pseudo-polyglot documents. In this case, delivery occurred via ZIP archive that contains an LNK file and a PNG file. The PNG file is pseudo-polyglot file in questio… Continue reading Intel in LNK Files→

Maurice posted on LinkedIn recently about one of the FeatureUsage Registry key subkeys; specifically, the AppSwitched subkey. Being somewhat, maybe even only slightly aware of the Windows Registry, I read the post with casual, even mild inter… Continue reading Registry: FeatureUsage→

I saw it again, just today. Another post on social media stating that IT teams/defenders “face unprecedented complexity”. This one stood out amongst all of the posts proclaiming the need for agentic AI on the defender’s side, due to how these… Continue reading Unprecedented Complexity→