Author Archives: Unknown

Very often in cybersecurity, we share some level of indicators of compromise (IOCs), such as IP addresses, domain names, or file names or hashes. There are other indicators associated with many compromises or breaches that can add a great deal of granu… Continue reading Artifact Tracking: Workstation Names→

Now and again, someone will ask me, “…how do you do analysis?” or perhaps more specifically, “…how do you use RegRipper?” This is a tough question to answer, but not because I don’t have an answer. I’ve already published a book on that ve… Continue reading Analysis Process→

I ran across a fascinating post from Cyber Sundae DFIR recently that talked about the Capability Access Manager, and how with Windows 11 it includes database of applications that have accessed devices such as the mic or camera, going beyond just t… Continue reading Rundown→

Anyone who’s followed me for a bit knows that I’m a huge proponent of metadata, and in particular, exploiting metadata in LNK files that threat actors create, use as lures, and send to their targets.I read an article not long ago from Splunk titled, LN… Continue reading Exploiting LNK Metadata→

I ran across a Cyber5W article recently titled, Windows Shell Item Analysis. I’m always very interested in not only understanding parsing of various data sources from Windows systems, but also learning a little something about how others view the topic… Continue reading Shell Items→

A recent LinkedIn thread led to a question regarding RegRipper educational materials, as seen in figure 1; specifically, are there any.Figure 1: LinkedIn requestThere are two books that address the use of RegRipper; Windows Registry Forensics, and Inve… Continue reading RegRipper Educational Materials→

I posted to LinkedIn recently (see figure 1), sharing the value I’d continued to derive from Events Ripper, a tool I’d written largely for my own use some time ago.Fig. 1: LinkedIn postFrom the comments to this and other LinkedIn posts regarding Events… Continue reading What is "Events Ripper"?→

Is “fileless” malware really fileless?Now, don’t get me wrong…I get what those who use this term are trying to say; that is, the actual malware itself, the malicious code, does not exist as a file on the local hard drive. However, for the uninitiated… Continue reading The Myth of "Fileless" Malware→

Rapid7 recently shared a fascinating post regarding the Kimsuky threat actor group making changes in their playbooks, specifically in their apparent shift to the use of .chm/”compiled HTML Help” files. In the post, the team does a great job of sharing … Continue reading A Look At Threat Intel Through The Lens Of Kimsuky→

I ran across an interesting LinkedIn post recently, “interesting” in the sense that it addressed something I hadn’t seen a great deal of reporting on; that is, ransomware threat actors dropping multiple RaaS variants within a single compromised organiz… Continue reading Threat Actors Dropping Multiple Ransomware Variants→