Collaborate Disseminate
MSSQL is still a thingTheDFIRReport recently posted an article regarding BlueSky ransomware being deployed following MSSQL being brute forced. I’m always interested in things like this because it’s possible that the author will provide clear observable… Continue reading Round Up
I received an interesting question via LinkedIn not long ago, but before we dive into the question and the response…If you’ve followed me for any amount of time, particularly recently, you’ll know that I’ve put some effort forth in correcting the ass… Continue reading …and the question is…
One of the things I love about the industry is that it’s like fashion…given enough time, the style that came and went comes back around again. Much like the fashion industry, we see things time and again…just wait.A good example of this is the fing… Continue reading Roll-up
I don’t like checklists in #DFIR. Rather, I don’t like how checklists are used in #DFIR. Too often, they’re used as a replacement for learning and knowledge, and looked at as, “…if I do just this, I’m good…”. Nothing could be further from the … Continue reading Roll-up
Some analysts may be familiar with the topic of time stomping, particularly as it applies to the NTFS file system, and is explained in great detail by Lina Lau in her blog. If you’re not familiar with the topic, give Lina’s article a very thorough read… Continue reading Investigating Time Stomping
On the heels of my previous blog post on this topic, I read a report that, in a lot of ways, really highlighted some of the issues I mentioned in that earlier post. The recent IDC report from Binalyze is telling, as it highlights a number of issues. On… Continue reading The State of Windows Digital Analysis, pt II
Something that I’ve seen and been concerned about for some time now is the state of digital analysis, particularly when it comes to Windows systems. From open reporting to corporate blog posts and webinars, it’s been pretty clear that there are gaps an… Continue reading The State of Windows Digital Analysis
I recently had an opportunity to review the book, Effective Threat Investigation for SOC Analysts, by Mostafa Yahia. Before I start off with my review of this book, I wanted to share a little bit about my background and perspective. I started my g… Continue reading Book Review: Effective Threat Investigation for SOC Analysts
Okay, so we’ve integrated Yara into the RegRipper workflow, and created “YARR”…now what? The capability is great…at least, I think so. The next step (in the vein of the series) is really leveraging it by creating rules that allow analysts to realiz… Continue reading The Next Step: Integrating Yara with RegRipper, pt II
It’s about that time again, isn’t it? It’s been a while since we’ve had a significant (or, depending upon your perspective, radical) shift in the cyber crime eco-system, so maybe we’re due. What am I referring to? Back in 2019, we saw a shift in r… Continue reading Yet Another Glitch In The Matrix