Jun 1, 2021
This week is about how size up a reported vulnerability quickly.
May 25, 2021
This week I tackle .NET. It is an ecosystem that is associated with malicious Powershell activity.
May 18, 2021
This week I revisited powershell from a process fast triage context.
May 11, 2021
This week is about the top threats to cloud computing.
May 4, 2021
This week I continue with the fast triage method for processes with a focus on historical records.
Apr 27, 2021
This week I cover threat modeling from a DFIR point-of-view. It provides a standard framework to classify and rate the severity of vulnerabilities discovered during investigations.
Apr 20, 2021
This week I run through a threat intel resource you may use for standardized attack information.
Apr 13, 2021
This week I revisit Svchost and the triage methods to apply.
Apr 6, 2021
This week is about the top threats to cloud computing.
Mar 30, 2021
This week is a case study that demonstrates the power behind IR fundamental methodology.
Mar 23, 2021
This week I continue with the fast triage method for processes with a focus on, well, everything else!
Mar 16, 2021
This week is about the top threats to cloud computing.
Mar 9, 2021
This week is about preparing for Golden SAML attacks for both Incident Response and Threat Hunting.
Mar 2, 2021
This week is about applying basic statistical analysis to threat hunting. The results are effective!
Feb 23, 2021
This week is about theatrics in security and how to avoid the trap.
Feb 16, 2021
This week I revisit Windows Core Processes and the triage methods to apply to them.
Feb 9, 2021
This week I talk about vulnhub, a free resource to practice ethical hacking skills and sharpen your DFIR skills.
Feb 2, 2021
This week I revisit Windows Core Processes and the triage methods to apply to them.
Jan 26, 2021
This week is the fourth part of the Network-Fast-Triage mini-series. In this installation I cover triage techniques for Windows event logs that record blocked network activity.
Jan 19, 2021
This week is about supply chain security posture from a DFIR point-of-view.
Jan 12, 2021
This week I go over a method to detect kernel process masquerading on Linux systems.
Jan 5, 2021
This week I interview author Shawn Livermore about the myth of the "tech-genius."
Dec 29, 2020
This week is the third part of the Network-Fast-Triage mini-series. In this installation I cover triage techniques for Windows event logs that record network port-binding.
Dec 22, 2020
This week is the second part of the Network-Fast-Triage mini-series. In this installation I cover triage techniques for Windows event logs that record network connections.
Dec 15, 2020
This week I cover triage techniques for werfault.exe. The process does not have the best documentation which makes it a challenge to triage.