Collaborate Disseminate
In 2005, Cory Altheide and I published the first peer-reviewed paper to address tracking USB devices on Windows systems. Over the years, it’s been pretty amazing to see not only the artifacts expand and evolve, but to also see folks pick up the baton a… Continue reading Analysis Playbooks: USB
First off, what is “analysis”? I submit that “analysis” is what happens when an examiner has investigative goals and context, and applies this, along with their knowledge and experience, to a data set. This can be anything, from a physical image of a m… Continue reading Registry Analysis
Not long ago, I ran across this LinkedIn post on analyzing a ransomware executable, which led to thisHexaStrike post. The HexaStrike post covers analyzing an AI-generated ransomware variant, which (to be honest) is not something I’m normally interested… Continue reading Analyzing Ransomware
I recently read through this FalconFeeds article on Qilin ransomware; being in DFIR consulting for as long as I have, and given how may ransomware incidents I’ve responded to or dug into, articles with titles like this attract my attention. I do not pr… Continue reading Ransomware artifacts
The awesome folks over at Cyber Triage recently published their 2025 Guide to Registry Forensic Tools, and being somewhat interested in the Windows Registry, I was very interested to take a look. The article is very well-written, and provides an excell… Continue reading RegRipper
I ran across Manuel Arrieta’s Hunting Fileless Malware in the Windows Registry article recently, and found it to be an interesting read.Let me start by saying that the term “fileless malware”, for me, is like finger nails dragged down a chalkboard. Par… Continue reading Hunting Fileless Malware
On the heels of my previous post on this topic, it occurred to me that this tendency to incorrectly refer to ShimCache and AmCache artifacts as “evidence of execution” strongly indicates that we’re also not validating program execution. That is to say,… Continue reading Program Execution, follow-up pt II
Last Nov, I published a blog post titled Program Execution: The ShimCache/AmCache Myth as a means of documenting, yet again and in one place, the meaning of the artifacts. I did this because I kept seeing the “…these artifacts illustrate p… Continue reading Program Execution, follow-up
As a follow-on to my previous post with this title, I wanted to keep the story going; in fact, there are likely to be several more posts in this series, so stay tuned.And hey, I’m not the only one sharing my journey! Check out Josh’s blog, particularly… Continue reading I’ve Seen Things, pt II
I like the movie “Blade Runner”. I’ve read Philip K. Dick’s “Do Androids Dream of Electric Sheep”, on which the movie is based. So what does this have to do with anything? Well, I’ve been around the industry for some time. I’ve added an… Continue reading I’ve Seen Things