Dear Blue Team: Proactive Steps to Supercharge your IR
In an age where data breaches and malware infections are quickly becoming the norm, we must prepare for Digital Forensics an…
Linux Binary Poisoning Detection
In this post guys from Sandfly Security describe the process of detection poisoned Linux binaries. You will learn about the …
Malicious PowerShell in the Registry: Persistence
Mari DeGrazia continues her series of blogs about detecting and analysis of malicious PowerShell scripts. This time you̵…
Parsing APFS with Magnet AXIOM
Despite the fact APFS isn’t currently supported by AXIOM, the author of “The Swanepoel Method” blog ran a …
RDP Logs and Incident Response
Koen Van Impe has posted a nice overview of RDP and its logs, that will be quite useful both for incident responders and for…
DFIR Summit & Training 2018
SANS Institute has published the presentations from DFIR Summit & Training 2018. You can find all of them here. …
TrueCrypt Container Recovery
Everything started from an encrypted container on a flash drive, which couldn’t be opened for some reason. The examina…
Detecting script-based attacks on Linux
In this post John Booth describes how to detect encoded or obfuscated command-lines used by attackers on Linus hosts. As you…
The Endgame Guide To Threat Hunting: Practitioner’s Edition
Threat hunting is the process of actively looking for signs of malicious activity within enterprise networks without prior k…
IoT 4n6: The Growing Impact of the Internet of Things on Digital Forensics
Here is the record of Jessica Hyde’s talk from Circle City Con 2018: …
