Collaborate Disseminate
Something that I’ve seen and been concerned about for some time now is the state of digital analysis, particularly when it comes to Windows systems. From open reporting to corporate blog posts and webinars, it’s been pretty clear that there are gaps an… Continue reading The State of Windows Digital Analysis
I recently had an opportunity to review the book, Effective Threat Investigation for SOC Analysts, by Mostafa Yahia. Before I start off with my review of this book, I wanted to share a little bit about my background and perspective. I started my g… Continue reading Book Review: Effective Threat Investigation for SOC Analysts
Okay, so we’ve integrated Yara into the RegRipper workflow, and created “YARR”…now what? The capability is great…at least, I think so. The next step (in the vein of the series) is really leveraging it by creating rules that allow analysts to realiz… Continue reading The Next Step: Integrating Yara with RegRipper, pt II
It’s about that time again, isn’t it? It’s been a while since we’ve had a significant (or, depending upon your perspective, radical) shift in the cyber crime eco-system, so maybe we’re due. What am I referring to? Back in 2019, we saw a shift in r… Continue reading Yet Another Glitch In The Matrix
A lot of writing and training within DFIR about the Registry refers to it as a database where configuration settings and information is maintained. There’s really a great deal of value in that, and there is also so much more in the Registry than just “… Continue reading Integrating Yara with RegRipper
I thought I’d continue The Next Step series of blog posts with something a little different. This “The Next Step” blog post is about taking a tool such as RegRipper to “the next step”, which is something I started doing in August, 2020. At first, I add… Continue reading The Next Step: Expanding RegRipper
The morning of 1 Aug, I found an article in my feed about a ransomware attack against a municipality; specifically, Montclair Township in New Jersey. Ransomware attacks against municipalities are not new, and they can be pretty devastating to staff and… Continue reading Ransomware Attack Timeline
I uploaded several new updates to Events Ripper plugins in the repo recently…defender.pl – added a check for event ID 2050 records, indicating that Defender uploaded a sample (as opposed to event ID 2051 records, indicating that a file could not be s… Continue reading Events Ripper Updates
My previous post on this topic addressed an apparent dichotomy (admittedly, based on a limited aperture) of thought between vendors and users when it comes to features being added to commercial forensic suites. This was the result of a road I’d st… Continue reading Thoughts on Tool Features, pt II
Not long ago, some exchanges and conversations led me to do something I’d never done before…post a poll on LinkedIn. These conversations had to do with whether or not analysts and practitioners within the industry felt there was adequate value propos… Continue reading Thoughts on Tool Features