Collaborate Disseminate
How often to DFIR analysts think about name resolution, particularly on Windows systems? I know that looking back across engagements I’ve done in the past, I’ve asked for DNS server logs but very often, these were not available. I’m sure others h… Continue reading Name Resolution
There are a number of settings within Windows systems that can and do significantly impact the functionality of Windows, and as a result, can also impact what is available to a #DFIR analyst. These settings very often manifest as modifications to… Continue reading Settings That Impact The Windows OS
The agenda for the 11th annual Open Source Digital Forensics Conference has been posted. I’ve attended OSDFCON before (several times), it’s one of the conferences where I’ve enjoyed presenting over the years. Maybe someone reading… Continue reading #OSDFCON
(Cross posted from the Securonix Blog)
Vulnerability management is one of the most basic security hygiene practices organizations must have in place to avoid being hacked. However, even being a primary security control doesn’t make it simple to succes… Continue reading Monitoring and Vulnerability Management
Amnesty International today exposed details of a new surveillance campaign that targeted Egyptian civil society organizations with previously undisclosed versions of FinSpy spyware designed to target Linux and macOS systems.
Developed by a German compa… Continue reading FinSpy Spyware for Mac and Linux OS Targets Egyptian Organisations
Dr. Chuvakin has recently delivered another great blog post about “detection as code”. I was glad to read it because it was the typical discussion we used have in our brainstorming conversations at Gartner. It had a nice nostalgic feeling :-). But it a… Continue reading DDLC – Detection Development Life Cycle
Dear Android users, if you use the Firefox web browser on your smartphones, make sure it has been updated to version 80 or the latest available version on the Google Play Store.
ESET security researcher Lukas Stefanko yesterday tweeted an alert demonst… Continue reading A Bug Could Let Attackers Hijack Firefox for Android via Wi-Fi Network
I recently ran across an interesting article from Sophos, indicating that the Maze ransomware threat group had taken a page from the Ragnar ransomware threat group. The article stated that the Maze group was seen delivering the ransomware i… Continue reading Toolmarks
The United States government today announced charges against 5 alleged members of a Chinese state-sponsored hacking group and 2 Malaysian hackers that are responsible for hacking more than 100 companies throughout the world.
Named as APT41 and also kn… Continue reading FBI adds 5 Chinese APT41 hackers to its Cyber’s Most Wanted List
An interesting result from changing jobs is seeing how people interpret your decision and how they view the company you’re moving to. I was happy to hear good feedback from many people regarding Securonix, reinforcing my pick for the winning car in the… Continue reading NG SIEM?