Category Archives: scripts

On the Fourth Day of APOLLO, My True Love Gave to Me – Media Analysis to Prove You Listened to “All I Want for Christmas is You” Over and Over Since Before Thanksgiving

Posted on by

The fourth day brings us media artifacts using the knowledgeC.db and CurrentPowerlog.PLSQL databases. Each database stores similar yet somewhat different records when it comes to audio, and video usage.Let’s get in the mood!
KnowledgeC.db Starting… Continue reading On the Fourth Day of APOLLO, My True Love Gave to Me – Media Analysis to Prove You Listened to “All I Want for Christmas is You” Over and Over Since Before Thanksgiving→

On the Third Day of APOLLO, My True Love Gave to Me – Application Usage to Determine Who Has Been Naughty or Nice

Posted on by

On this third day, we will focus on application usage. We will cover three databases:KnowledgeC.dbBe sure to check out more detailed information on this database in my two previous articles.Access to this database is limited to a file system dump, it w… Continue reading On the Third Day of APOLLO, My True Love Gave to Me – Application Usage to Determine Who Has Been Naughty or Nice→

On the First Day of APOLLO, My True Love Gave to Me – A Python Script – An Introduction to the Apple Pattern of Life Lazy Output’er (APOLLO) Blog Series

Posted on by

I originally released APOLLO at the Objective by the Sea conference in early November. Since then I’ve received a surprising amount of positive feedback about various analysts using this tool or the accompanying SQL queries on their file system dumps t… Continue reading On the First Day of APOLLO, My True Love Gave to Me – A Python Script – An Introduction to the Apple Pattern of Life Lazy Output’er (APOLLO) Blog Series→

Slides and Script! From Apple Seeds to Apple Pie & Introducing APOLLO: The Apple Pattern of Life Lazy Output’er

Posted on by

I had the privilege and honor to present at the first ever Objective by the Sea Mac Security Conference yesterday in Maui (hardship, right?). It was only the first day and it was absolutely spectacular, I may have to make this one a regular! I can easi… Continue reading Slides and Script! From Apple Seeds to Apple Pie & Introducing APOLLO: The Apple Pattern of Life Lazy Output’er→

Windows 10 Decontamination Scripts

Posted on by

One of the main benefits of our setup we have is that our system will not update automatically. The main problem though, is that it will not update automatically. But we still do want security updates, so it would be nice to let those through, while still blocking any other unwanted updates and the other undesirable activity that is also conducted from the same process (svchost.exe). So instead, I installed Python and wrote my own, which was far less difficult than I had originally assumed since you can generally scrape all the info you want from catalog.update.microsoft.com Continue reading Windows 10 Decontamination Scripts→

Everything You Need to Know About Azure Infrastructure — June 2018

Posted on by

We’re entering the laid-back days of Summer. There isn’t much Azure IaaS news, but we’re after quality, not quantity.  June was a good news month for those of us using Microsoft Azure.

The post Everything You Need to Know About Azure Infrastructure — June 2018 appeared first on Petri.

Continue reading Everything You Need to Know About Azure Infrastructure — June 2018→

Why the Last Login Date Reported by the Get-MailboxStatistics Cmdlet is so Wrong

Posted on by

The venerable Exchange Get-MailboxStatistics has been around for over ten years, but now it’s telling lies about Office 365 users. Well, just the last login date to their mailbox. The problem is that the world is a very different place to when Microsoft first introduced PowerShell in Exchange 2007. Mailboxes didn’t get so many visits from mailbox assistants then…

The post Why the Last Login Date Reported by the Get-MailboxStatistics Cmdlet is so Wrong appeared first on Petri.

Continue reading Why the Last Login Date Reported by the Get-MailboxStatistics Cmdlet is so Wrong→

New Deepfakes forum goes mining with Coinhive

Posted on by

With the collapse of the main Deepfakes hubs on Reddit, users have moved away to other forums. Problem is, at least one of them is mining for cryptocurrency. Can your PC handle it?
Categories:

Cybercrime
Privacy

Tags: bitcoinbitcoinscryptocurre… Continue reading New Deepfakes forum goes mining with Coinhive→

Script Update – Mac MRU Parser v1.5 – Added Volume Analysis Support and Other Stuff!

Posted on by

Get the script here!Added volume analysis support for the following plists. These are not really MRUs but it could be damn useful to gather this info.Sidebar List plist [10.12-] – /Users/<username>/Library/Preferences/com.apple.sidebarl… Continue reading Script Update – Mac MRU Parser v1.5 – Added Volume Analysis Support and Other Stuff!→