This week I talk about how to triage Windows events for network listening activity.

This week I talk about an approach for reviewing Windows event logs.

This week I talk about an approach for reviewing CMD syntax for findings.

This week I talk about essential network basics necessary for triage.

This week I talk about Webshell forensics.

This week I talk about Webshell forensics.

This week I talk about Windows startup locations.

This week I talk about Windows Prefetch forensics.

This week I talk about fileless attacks Linux systems.

This week I talk about how to find evidence of malicious autoruns in the windows registry using Windows event codes.

This week I talk about strategies to determine root cause early during an investigation.

This week is a breakdown of HTTP log forensic triage.

This week I talk about finding evidence of Kernel file masquerading on Linux systems.

This week I talk about how to find evidence of malicious autoruns in the windows registry.

This week I talk about the forensic value of the Apple Spotlight DB.

When you talk autoruns you must talk about the Windows registry. This artifact is very dense and it may be difficult to zero in on the elements that are important for compromise assessment. Given that, I am going to begin the series with a breakdown of the Windows Registry from a DFIR point of view. This is crucial in understanding ...

This week I talk about the attack methodology known as Fast Flux.

This week’s focus is on other scheduled task events useful for DFIR triage.

This week I talk about a popular Windows utility attackers often exploit.

This week I breakdown the SUDOERS file for forensic triage.

This week’s focus is on new scheduled tasks, which are a common way of establishing longevity on system. I will have my breakdown of the artifact and how to interpret it for fast analysis coming up….

The must-attend event for Cyber First Responders who must detect and deal with ransomware, zero-day events, and more!

This week I talk about the Windows Background Activity Monitor, an artifact that may be used to find evidence of execution.

This week I breakdown CRON for the uninitiated.

This week is about persistence artifacts. Namely the records for when services fail to start, are either started or stopped, have crashed have had their start type changed. Since services are one of the common ways attackers achieve persistence, understanding how these events may be used for triage purposes is very important...