Collaborate Disseminate
The folks over at CyberTriage recently shared a complete guide to WMI; it’s billed as a “complete guide to WMI malware”, and it covers a great deal more than just malware. They cover examples of discovery and enumeration, as well as execution, but what… Continue reading WMI
I read something interesting recently that stuck with me. Well, not “interesting”, really…it was a LinkedIn post on security sales. I usually don’t read or follow such things, but for some reason, I started reading through this one, and really engagi… Continue reading The Problem with the Modern Security Stack
Lina recently posted on LinkedIn that she’d published another blog post. Her blog posts are always well written, easy to follow, fascinating, and very informative, and this one did not disappoint.In short, Lina says that she found a bunch of Chinese bl… Continue reading Lina’s Write-up
The role of AI in DFIR is something I’ve been noodling over for some time, even before my wife first asked me the question of how AI would impact what I do. I guess I started thinking about it when I first saw signs of folks musing over how “good” AI w… Continue reading The Role of AI in DFIR
In order to fully understand digital analysis, we need to have an understanding of the foundational methodology, as well as the various constituent artifacts on which a case may be built. The foundational methodology starts with your goals…what are y… Continue reading Artifacts: Jump Lists
Recovering deleted data, or “carving”, is an interesting digital forensics topic; I say “interesting” because there are a number of different approaches and techniques that may be valuable, depending upon your goals. For example, I’ve used X-Ways … Continue reading Carving
A while back, Jesse Kornblum published a paper titled, “Using Every Part of the Buffalo in Windows Memory Analysis”. This was, and still is, an excellent paper, based on it’s content and how it pertained to the subject (Windows memory analysis). Howeve… Continue reading UEPOTB, LNK edition
I recently saw another LinkedIn post from someone supporting and sending readers to a site that was reportedly started using the SANS DFIR poster as a reference. As illustrated in figure 1, this site references the ShimCache artifact as providing evide… Continue reading Program Execution: The ShimCache/AmCache Myth
I had the distinct honor and pleasure of speaking at the “From The Source” Conference (FTSCon) on 21 Oct, in Arlington, VA. This was a 1-day event put on prior to the Volexity memory analysis training, and ran two different tracks…Maker and Hunter…… Continue reading FTSCon
Very often in cybersecurity, we share some level of indicators of compromise (IOCs), such as IP addresses, domain names, or file names or hashes. There are other indicators associated with many compromises or breaches that can add a great deal of granu… Continue reading Artifact Tracking: Workstation Names