Collaborate Disseminate
While analyzing real-world systems, memory analysts will often encounter anti-virus (AV) engines, EDRs, and similar products that, at first glance, look suspiciously like malware. This occurs because these security products leverage the same techniques… Continue reading When Anti-Virus Engines Look Like Kernel Rootkits
Recently someone had asked on a mailing list about how to extract the registry value names that were created by a particular piece of malware. The issue was a NULL (0x0) character at the beginning of the registry value name, which prevented regedit fr… Continue reading Registry Value Names Starting with NULL Characters
Recently someone had asked on a mailing list about how to extract the registry value names that were created by a particular piece of malware. The issue was a NULL (0x0) character at the beginning of the registry value name, which prevented regedit fr… Continue reading Registry Value Names Starting with NULL Characters
Since someone had asked about it in a comment on this blog, I decided to write up a Volshell Quickie on the Volatility Labs blog. Enjoy! Continue reading Volshell Quickies
Since someone had asked about it in a comment on this blog, I decided to write up a Volshell Quickie on the Volatility Labs blog. Enjoy! Continue reading Volshell Quickies
The other day someone reached out to me because they had a case that involved files with Arabic names. Unfortunately the filenames were only question marks when using filescan or handles, so I set out to figure out why.
In order to figure out why, I… Continue reading Volshell Quickie: The Case of the Missing Unicode Characters
The other day someone reached out to me because they had a case that involved files with Arabic names. Unfortunately the filenames were only question marks when using filescan or handles, so I set out to figure out why.
In order to figure out why, I… Continue reading Volshell Quickie: The Case of the Missing Unicode Characters