Collaborate Disseminate
Keeping with the theme from my previous blog post of building on what others have done and written about, and of assembling the pieces that are already available to build on a foundation built by others, I found something interesting that seems like a … Continue reading The Next Step: VHD Files and Metadata
A lot of times, we’ll run across something or read something really very profound and valuable, something that opens our eyes and makes us go, “oh, wow”, and impacts us enough that it changes the way we do things. I can say that of a number of blogs po… Continue reading The Next Step
Something I really, really like about tools like RegRipper and Events Ripper is that when I see something in the data during an investigation, I can explore whether it makes sense to pull that out and make it visible to the investigator, and if so, fig… Continue reading Events Ripper Update
In May 2022, Kaspersky published a write-up on a newly-discovered campaign where malware authors wrote shellcode to the Windows Event Log. This was pretty interesting, and just about 4 months later, Tim Fowler published this blog post over at BlackHill… Continue reading Hiding In The Windows Event Log
There’s been a lot of ink put toward resume recommendations and preparing for interviews over the years, and I feel like there’s been even more lately, given the number of folks looking to transition to one of the cybersecurity fields, as well as tech … Continue reading Interview Questions
I’ve posted previously on validation, and more recently, on validation of findings. In my recent series of posts, I specifically avoided the top of tool validation, because while tool validation predicates the validation of findings, and there is some … Continue reading Validation – This Time, Tool Validation
My copy of “Forensic Discovery”There are a lot of folks new to the cybersecurity industry, and in particular DFIR, and a lot of folks considering getting into the field. As such, I thought it might be useful to share my view of the core, foundational p… Continue reading DFIR Core Principles
Barely a week goes by and we see another yet post on social media that discusses knowledge sharing or “training” in cybersecurity, and in particular, DFIR and Windows forensic analysis. However, many times, these posts aren’t “new”, per se, but instead… Continue reading The Need for Innovation in DFIR
Yet again, recent incidents have led to Events Ripper being updated. This time, it’s an updated plugin, and a new plugin.appissue.pl – I updated this plugin based on Josh’s finding and Tweet; I can’t say that I’ve ever seen this event before, but when … Continue reading Events Ripper Update
Working a recent incident, I came across something very unusual. I started by going back into a previous investigation run against the endpoint that had been conducted a month ago, and extracting the WEVTX files collected as part of that investigation…. Continue reading Events Ripper Update