Digital Forensic Survival Podcast

DFSP # 454 MFA Bypass Attacks Oct 29, 2024

This week I talk about the attack methods being used to bypass MFA. We'll learn about real-world cases where MFA was circumvented, and discover best practices to strengthen defenses against these types of attacks...

DFSP # 453 Windows Startup Locations Oct 22, 2024

In today’s episode, we’ll focus on startup folders, which are perhaps the easiest to triage among all persistence mechanisms. But before diving in, let’s recap the journey so far to underscore the importance of a comprehensive approach rather than a one-off tactic. Each triage area we've covered plays a crucial role in identifying and stopping attacks...

DFSP # 452 AI and DFIR Oct 15, 2024

In 2024, AI has not only revolutionized how we defend against cyber threats but also how those threats are being carried out. We'll explore how AI is enabling faster, more efficient security incident responses, with real-world examples of its application in automated threat detection and response, advanced forensics, and more. But with every technological leap forward, there's a dark side and attackers are harnessing AI to orchestrate sophisticated attacks...

DFSP # 451 SQL Triage Oct 08, 2024

SQL injection poses significant risks by enabling attackers to access sensitive metadata, execute dynamic SQL commands, and alter system parameters. These actions can lead to unauthorized data access and system disruptions, especially if attackers gain elevated privileges. This week I'm talking about SQL attack patterns from a triage point of view to help you detect such activity when doing log analysis...

DFSP # 450 Secure coding and DFIR Oct 01, 2024

I decided to talk this week about the Importance of Secure Coding Knowledge for Security Incident Response Investigations. Knowing secure coding principles helps identify the root causes of vulnerabilities and recognize attack patterns. It facilitates effective communication and collaboration with developers, ensuring accurate incident reports and actionable recommendations. Secure coding knowledge enhances forensic analysis by aiding in code reviews and log analysis to detect anomalies. It also allows responders to suggest mitigation strategies and improve the security posture of applications. Ultimately, this knowledge leads...

DFSP # 449 Zero-Day or Hero-Day Sep 24, 2024

This week, we're covering zero-day vulnerability response from a Digital Forensics and Incident Response professional's perspective. In our roles, we often get involved in various tasks that require a security mindset, and one critical task is responding to zero-day vulnerabilities. To provide a real-world context, we'll integrate the recently disclosed zero-day exploit "Copy2Pwn" (CVE-2024-38213) and discuss the specific forensic artifacts and methods used to achieve the objectives of a DFIR response.

DFSP # 448 WebShell Forensics Sep 17, 2024

Welcome to this week’s session, where we’ll delve into web shell forensics—an ever-critical topic in incident response investigations and threat-hunting strategies. Today, I’ll provide a breakdown that includes the latest developments, detailed triage techniques, and practical examples of what to look for during your investigations:

DFSP # 447 Linux Root Kits Sep 10, 2024

Rootkits are hard to detect because they employ advanced stealth techniques to hide their presence. They can conceal processes, files, and network activities by altering system calls and kernel data structures. The deep system knowledge and specialized tools required for low-level analysis make rootkit detection complex and resource-intensive. Limited visibility of standard security tools further complicates the identification of rootkits. However, This week I'm going to talk about how to identify root kits on a Linux systems using only the command line.

DFSP # 446 Registry by EVTX Sep 03, 2024

In previous episodes, we covered techniques for examining the Windows Registry, a critical component in identifying persistence mechanisms. We'll explore the registry but shift our focus to registry modification events as reported by Windows event logs

DFSP # 445 Bash Triage Aug 27, 2024

Bash history's forensic value lies in its ability to answer diverse investigative questions, making it a cornerstone artifact for Linux systems. It aids in triaging lateral movement, identifying reconnaissance activities, and detecting attempts at establishing persistence. This underscores the importance of structuring triage tasks around specific investigative questions, facilitating focused analysis amidst potentially extensive Bash history records...

DFSP # 444 A little assistance Aug 20, 2024

The UserAssist key is a Windows Registry artifact that logs details about user activity, such as recently accessed programs and files. It encodes information on the frequency and last access time of items launched via Windows Explorer. This helps investigators understand user behavior and timeline of actions on a system, providing evidence of program execution and file access...

DFSP # 443 - Standard Actions Aug 13, 2024

Every incident response outfit should have a set of guidelines for their team which outlines the standard actions or common considerations for security investigations. In this episode, I highlight some of the key points for security teams with a special focus on initial actions which typically set the tone for success during the subsequent investigation.

DFSP # 442 - Database Response Aug 06, 2024

Understanding the different types of databases is important for security incident response investigations, as databases are often targeted by attackers seeking sensitive information. Each database type—relational, NoSQL, in-memory, and cloud-based—has unique structures, query languages, and security mechanisms. Familiarity with these variations enables investigators to effectively...

DFSP # 441 - CIS Benchmarks Jul 30, 2024

CIS (Center for Internet Security) Benchmarks provide a comprehensive set of best practices for securing IT systems and data, which are vital for security response investigations. These benchmarks, developed through a consensus-driven process by cybersecurity experts, offer detailed guidelines for configuring operating systems, applications, and network devices to enhance their security posture. In the context of security response investigations, adhering to CIS Benchmarks helps ensure that systems are resilient against common threats and vulnerabilities. By implementing these benchmarks, organizations can better detect, respond to, and recover from security incidents, thereby minimizing potential damage and improving overall cybersecurity hygiene.

DFSP # 440 - ABCs of BECs Jul 23, 2024

Business Email Compromise (BEC) forensics involves the meticulous investigation of cyberattacks where attackers infiltrate email systems to manipulate business communications for financial gain. These attacks often entail phishing, social engineering, and credential theft to impersonate trusted entities within or outside an organization. Forensic analysis of BEC incidents focuses on tracing the attacker's entry point, examining email headers, metadata, and logs to uncover the methods used for unauthorized access. It also involves identifying compromised accounts, understanding the scope of the attack, and preserving evidence for legal proceedings. Effective BEC forensics is crucial for mitigating financial losses, strengthening cybersecurity defenses, and preventing future incidents.

DFSP # 439 - Remoting Windows Jul 16, 2024

Remote Desktop Protocol (RDP) is a crucial artifact in digital forensics due to its extensive use for remote system access. Analyzing RDP activities can uncover vital information about unauthorized access, insider threats, and attacker lateral movement within a network. Forensic examination of RDP logs enables investigators to trace an attacker's steps, identify compromised accounts, and assess the breach's extent. For instance, RDP forensics can detect brute force attacks on login credentials, track the use of stolen credentials, and monitor suspicious reconnection attempts to previously established sessions.

DFSP # 438 - Old Nix Jul 09, 2024

This week, I will be discussing the Linux operating system from a DFIR perspective. It is highly recommended for every examiner to become proficient in Linux, especially with the increasing prevalence of cloud-based infrastructures in enterprise environments. As these platforms become the norm, you can expect to encounter Linux systems frequently during your investigations.

DFSP # 437 - Windows Autoruns Jul 02, 2024

In Windows forensics, understanding the intricacies of autorun functionalities and the Windows Registry is essential for effective incident response and investigation. Autorun mechanisms, which allow programs to execute automatically when the system starts or specific actions are performed, can be exploited by malicious actors to persist on a system. The Windows Registry, a hierarchical database that stores low-level settings for the operating system and applications, plays a crucial role in tracking these autorun entries. Forensic analysis of the Windows Registry can reveal information about auto-starting applications, system configurations, and user activities, providing insights into potential security breaches and unauthorized changes.

DFSP # 436 - Ja-Who? Jun 25, 2024

The JOHARI methodology simply provides a structure for something that you're probably already doing. However, with the structure comes a standard, which is the benefit to any security team. The team should be speaking the same language, especially in fast moving, dynamic situations. Going into a situation and asking for the "known – knowns” and “Blindspots" should register with every team member without any question about their definitions...

DFSP # 435 - Good Ol’ Powershell Jun 18, 2024

Threat actors often exploit PowerShell in cyber attacks due to its capabilities and integration with Windows operating systems. Microsoft has cited powershell as one of the most commonly used tools in the attack chain. It also comes up in phishing campaigns and other attacks that include infecting URL links. The challenge lies in the fact that it is a commonly used administration tool. As an analyst, you can expect to have lots of powershell scripts and commands come up during your investigations. Your job is to be able to differentiate between the good and bad. Fortunately, this episode is going to give you some tips and tricks on how to do exactly that...

DFSP # 434 - The Reg Jun 11, 2024

The Windows registry is a hierarchical database that stores configuration settings and options on Microsoft Windows operating systems. It contains settings for low-level operating system components as well as for applications running on the platform. In order to make use of any of this information, you must understand the registry from a DFIR point of view, and that's exactly what I'm doing in this episode...

DFSP # 433 - SU DOs and DONTS Jun 04, 2024

On a Linux or Mac system, there can be user accounts that have the ability of privilege escalation. Knowing how to triage, for this has a twofold benefit: (1) you obviously want to know which account may elevate to route privileges. If you're doing account triage, these are the ones you should prioritize. The other benefit (2) is to identify any account that can escalate. This fact alone ...

DFSP # 432 - Control Bits May 28, 2024

TCP control bits are part of the TCP header and are used to manage the connection between two devices. These control bits are single-bit flags that indicate various aspects of the TCP connection and are important for understanding and analyzing network traffic...

DFSP # 431 - Finding Needles May 21, 2024

The time it takes from an initial escalation to the initial discovery of compromise is a key metric. Teams strive to do this as quickly as possible, but there are a number of challenges. You do not know what you're going to be handed, but you're pretty much guaranteed It's going to be a unique set of circumstances that require some type of customized or mostly customized response. So how do you accomplish this? Most analyst rely on a set of tried and true various techniques that can be used at scale. This week I'm going to cover a few of them, each being a critical technique you should be familiar with for forensic investigations...

DFSP # 430 - Targeting Tasks May 14, 2024

Windows Scheduled Tasks are often used by attackers to establish persistence. As an analyst, you want to be aware of the different windows event codes that record these details. These artifacts come up in just about every windows compromise assessment, consider them core triage skills. There are several events, all of which I will go over in this episode. I will break them down from a DFIR point of view and give you the triage methodology...

DFSP # 429 - Career Moves May 07, 2024

This week I talk about career moves for the DFIR professional. The skill set is valuable, but it must be combined with the right additional technical skills to maximize future job opportunities. Of course, there is one skill set that stands out above the rest...

DFSP # 428 - It’s all about that XML Apr 30, 2024

When you're triaging a Windows system for evidence of compromise, it's ideal if your plan is focused on some quick wins upfront. There are certain artifacts that offer this opportunity, and Windows Events for New Scheduled Tasks are one of them. Sometimes overlooked, at least in part, because the good stuff contained within the XML portion of the log. This week I'm covering the artifact from a DFIR point of view, I'll go over all the elements of the log entry that are of interest for investigations, and I'll provide a triage methodology that you can employ to find evidence quickly.

DFSP # 427 - MOF Balls Apr 23, 2024

Windows management instrumentation, also known as WMI, is an App on Windows that allows a user to query all sorts of things about a system. Being native to Windows, it is an attractive target for a attackers to leverage. This week I'll break down the artifact from a DFIR point of a few and talk about how to detect its misuse.

DFSP # 426 - SSH Forensics: Log Analysis Apr 16, 2024

This week I'm wrapping up my series on SSH forensics with a discussion on SSH log triage. Logs are usually what an analyst will start with, so this episode is important. There are a few different log types, and there is a pitfall with one of them, which is something you must be aware of to avoid making inaccurate conclusions. I'll provide the artifact breakdown, triage methodology, and more.

DFSP # 425 - SSH Forensics: Host-Based Artifacts Apr 09, 2024

In the last episode on this topic, I covered SSH from a investigation point of view. I explained SSH and the artifacts that typically come up when your investigating. In this episode, we're getting into the triage methodology. This includes the artifacts targeted for a fast, but yet effective triage for notable SSH activity on a given host.

DFSP # 424 - SSH Forensics: Understanding Secure Shell Apr 02, 2024

SSH is a protocol used to secure remote access to systems, making it a cornerstone in safeguarding sensitive information and ensuring secure communications. In this podcast, we will delve into the basics of SSH, its key concepts and other useful elements important for context when investigating for notable SSH activity.

DFSP # 423 - Guiding Lights: Cyber Investigations Investigation Lifecycle Mar 26, 2024

This week I'm discussing a fundamental aspect of cybersecurity: incident response preparation. Effective incident response is paramount, and preparation is the key to success. This preparation includes comprehensive documentation, training, having the right tools and resources in place, and developing incident response plans and playbooks. It also involves ensuring clear communication protocols and conducting regular training and testing.

I'll explore preparation from the perspective of the investigation life cycle, where success is the reward for preparation. Join me as I uncover the importance of preparation in incident response and how it lays the foundation for success in investigations.

DFSP # 422 - EVTX Express: Cracking into Windows Logs Like a Pro Mar 19, 2024

Today I'm talking Windows forensics, focusing on Windows event logs. These logs are very valuable for fast triage, often readily available in your organization's SIEM. But have you ever wondered about the processes enabling this quick access? Not only are the logs automatically collected and fed into the appliance, but they are also formatted and normalized for easy data searchability. This is crucial, as the logs are originally in a complex format challenging to natively interpret. Now, picture a scenario where event logs are inaccessible through a security appliance—enter this week's topic: EVTX analysis options. Don't be caught unprepared.

DFSP # 421 - Memory Lane: Fileless Linux Attacks Unraveled Mar 12, 2024

In this podcast episode, we talk about Linux's `memfd` – a virtual file system allowing the creation of anonymous memory areas for shared memory or temporary data storage. Threat actors exploit `memfd` for fileless malware attacks, as its memory areas exist only in RAM, evading traditional file-based detection methods. Join me as I `memfd` as a forensic artifact, its implications in DFIR, and strategies for detecting its abuse.

DFSP # 420 - Failing, Stopping and Crashing Mar 05, 2024

This week we explore into the world of Windows service event codes and their role in forensic investigations. Windows services are background processes crucial for system functionality, running independently of user interaction- making them ideal. Target were exploitation. Join me to explore the intricate details of Windows services and their significance in digital forensics.

DFSP # 419 - What the Flux Feb 27, 2024

This week, we're delving into the realm of fast flux, a cunning technique employed by attackers to cloak their true, malicious domains. Its effectiveness is the reason behind its widespread use, making it crucial for analysts to grasp its nuances and avoid chasing elusive ghosts during investigations. Stay tuned as I unravel the intricacies of fast flux, providing insights into what it entails and offering valuable tips on how to effectively detect it. All this and more coming your way!

DFSP # 418 - Core Insights: Navigating MFT in Forensics Feb 20, 2024

In this week's exploration, I'm delving into the intricate realm of the Master File Table (MFT), a pivotal forensic artifact in Windows investigations. The MFT provides a valuable gateway to decode evidence across various scenarios. Join me in this episode as we unravel the forensic basics, explore diverse use cases, and discover a range of tools that empower you to unlock the full potential of this invaluable artifact.

DFSP # 417 - Unlocking Linux Secrets Feb 13, 2024

This week I delve into the intriguing domain of Linux malware triage. The Linux platform presents forensic analysts with a unique opportunity to excel in performing malware triage effortlessly. The beauty of it lies in the fact that you don't require any specialized tools; all you need is a solid grasp of a few commands and the ability to decipher their output. With these skills in your arsenal, any analyst can swiftly and efficiently navigate through the process of malware triage. Stay tuned for more insights on this in the upcoming discussion!

DFSP # 416 - Persistence Mechanisms on Windows Feb 06, 2024

This week I’m going to talk about New Service Installation details recorded in Windows event logs. These have a number of advantages for your triage methodology and I will have all the details coming up.

DFSP # 415 - Dealing with Third-Party Incidents Jan 30, 2024

Organizations leverage third-party services more and more for business advantages. For the security professional, this means the organizational data you're charged with protecting is under the control of a third-party in some way shape or form. In this episode, I cover third-party risk landscape for security professionals with a special focus on identifying scope and responsibility.

DFSP # 414 - CRON Forensics Jan 23, 2024

Cron become important and Linux forensics when you’re talking about persistence. Think scheduled tasks if you want a Windows equivalent. The artifact is not that difficult to analyze once you understand the elements to focus on and it is typically readily available. It’s something that you can check out a live system, gather with a collection script, and more and more security appliances are designed to access the artifact as well. I’ll...

DFSP # 413 - Ransomware Initial Response Jan 16, 2024

Ransomware cases can be particularly challenging, especially during the initial response. They tend to be fast-paced and require the responder to simultaneously prioritize a number of tasks. Each of these tasks can have critical impact upon the outcome of the response and subsequent investigation. In this episode I am going to cover some immediate response actions. The goal here is to provide a framework that will allow responders to get off on the right foot…

DFSP # 412 - Conhost Forensics Jan 09, 2024

Conhost, or the Console Application Host, often comes up during investigations. Understanding what it is, the evidence may contain and how to extract that information becomes important...

DFSP # 411 - NTLM Credential Validation Jan 02, 2024

This week I'm talking about detecting evidence of lateral movement on Window systems using NTLM credential validation events. Much like the episode I did on Kerberos, NTLM events offer the same advantage of being concentrated on domain controllers, which allows you, as the analyst, leverage a great resource for user account analysis. I will have the background, artifact breakdown, and triage strategy coming up right after this…..

DFSP # 410 - Linux Temp Directories Dec 26, 2023

Temporary directories play a significant role in computer forensic investigations as they can potentially contain valuable digital evidence. When conducting a computer forensic investigation, these temporary directories can provide insights into user activities, application usage, and potentially malicious behavior...

DFSP # 409 - Regsvcs and Regasm Abuse Dec 19, 2023

This week I’m talking about Regsvcs /Regasm exploitation, which is a Windows tactic attackers use to evade defense mechanisms and execute code. Specifically, this technique can be used to bypass process whitelisting and digital certificate validation. I'll break down some interpretation methods that may be used to identify such exploitation....

DFSP # 408 - Nesting Dec 12, 2023

This week I’m talking about Nested Groups and the risk they pose for security. Built-in to the functionality of Active Directory is the ability to attach a group to another group. While this has advantages for account administration across an organization, it also offers attackers opportunity if certain precautions are not taken. This week I’ll break down Nested Groups in DFIR terms, talk about how attackers take advantage of it and what analysts need to know for investigations.

DFSP # 407 - More About Lateral Movement and Kerberos Dec 05, 2023

This week it's more about lateral movement and kerberos events.

DFSP # 406 - All the BIN Directories Nov 28, 2023

In a typical Linux "bin" directory, you can find various types of executable files and scripts that are used to perform different tasks. The confusing part is that there are a number of different BIN directories throughout the file system. What is the purpose and difference between these BIN directories? What do you need to know about them for forensic investigations? The answers to those questions and more are coming up...

DFSP # 405 - Werfault Attacks Nov 21, 2023

Werfault is in interesting artifact in that there is not a lot of documentation on it but yet it may affect an investigation in different ways. Its appearance in logs sometimes adds a bit of confusion to an investigation because it could mean different things. Add to that a layer of apparent obscurity as to exactly how to interpret the information makes it even more difficult for newer examiners. I took on the question...

DFSP # 404 - Certutil Attacks Nov 14, 2023

Certutil, a powerful command-line utility, possesses the potential for misuse by malicious actors to establish illicit network connections. Therefore, it is crucial to familiarize oneself with its legitimate applications and recognize common indicators of misuse. In this episode, we will delve into the utility of Certutil and identify effective methods to promptly detect and address potential abuses. Stay tuned as we explore these topics in depth...

DFSP # 403 - Lateral Movement Kerberos Auth Events Nov 07, 2023

This week I'm going to cover an important Windows event that provides valuable information about authentication attempts and potential security breaches. The event may be used to identify compromised accounts, identify brute, force, attacks, or password spraying attacks. It may also be used to detect attack or probing activities. The artifact breakdown and triage methodology is coming up….

DFSP # 402 - Linux Root Directory Files for DFIR Oct 31, 2023

In Linux and Unix-based operating systems, the "root" account is the superuser or administrator account with the highest level of privileges. It has complete control over the system and can perform any action, including modifying system files, installing software, and managing user accounts. The root account is sometimes referred to as the "root user" or simply “root"....

DFSP # 401 - INF Fetch Execute Oct 24, 2023

This week we are taking a bit of a deep dive into an advanced attack technique to accomplish remote execution called “fetch and execute.” While there are different methods to accomplish the sort of thing what I am going to be focusing on is exploitation using a common Windows executable and installation file. Think of this as one of the touted “living off the land” attack techniques. It has value for compromise assessment methods as well as for threat hunting strategies...

DFSP # 400 - CMSTP Oct 17, 2023

This week I am going to focus on a specific remote execution technique that you may see in the wild. Remote execution is important for incident response investigations but also for file use and knowledge investigations, particularly those that conducted due diligence exams for evidence of malware. I have covered remote execution in the past from different angles and I have done so because it is one of the red flags that an analyst should be looking for. In order to be effective in recognizing either an actual malicious execution or the risk of an attempted remote execution you must be reversed in the clever ways attackers attempt to compromise a host using Microsoft applications. The highlight this week will be CMSTP.exe abuse...

DFSP # 399 - Lateral Movement Failed Logon Events Oct 10, 2023

Finding and analyzing failed logons sometimes is just as important as finding suspicious, actual logon activity. Like anything, context is important. Old logon records offer an opportunity to identify not only suspicious activity, but perhaps attempted activity by an attacker. A standard move in the attack chain is to compromise an account and use it to move within the breached environment. However, it doesn't always work as planned for the attacker, and you may find failed activity a valid signal for identifying, malicious actions. This episode, I'm going to take a look at failed logon events from an investigation point of you.

DFSP # 398 - OODA & JOHARI Oct 03, 2023

This week I will discuss the use of the OODA loop and JOHARI window in security incident response investigations. These two frameworks are designed to help organizations quickly and effectively respond to security incidents, and can be used in combination to enhance incident response capabilities....

DFSP # 397 - Linux Home Directory Files for DFIR Sep 26, 2023

This week I'm talking about the linux file system from the point of view of a forensic analyst. In general, it's a good idea to have a solid working knowledge of the linux file system so you understand what directories hold what artifacts… Or if you're looking for a specific category of artifact, you at least have an idea of where you may find it. I will cover the home directory this week and breakdown the typical forensic artifacts you find there……

DFSP # 396 - URL Leak Sep 19, 2023

This week I will talk about investigating data spill cases involving exposed URLs. This is a typical privacy investigation many incident response teams handle and I thought it would be useful to go over some standard guidelines for handling such cases. To be effective with these investigations you need to know how to determine liability and responsibility, a little Google foo, and a number of odds and ends concerning mitigation, containment and remediation strategies....

DFSP # 395 - Lateral Movement and Admin Logons Sep 12, 2023

This week is on lateral movement detection techniques. Inspecting Domain Admin account logons is a key component to lateral movement triage. Admin accounts are sought after by attackers for their elevated privileges. Evidence is often left behind both on the targeted system and on the domain controller. Both these factors provide protection opportunity through Windows event log analysis. I’ll break down the method....

DFSP # 394 - Functional Documentation Sep 05, 2023

This week I want to talk about the value of having functional documentation for your organization, or, at least for your team. Functional documentation means you have thoughtful and up-to-date incident run books, and play books that provide utility and usefulness for a responder. Without such documentation, you are always in danger of some dangerous pitfalls, some of which I'll discuss. This episode I cover what functional documentation is, it's investigative value for an organization, how to get started...

DFSP # 393 - Linux Subsystems for Windows Aug 29, 2023

The linux subsystem for windows, create both opportunity and challenges for forensic analysts. It makes Windows an excellent platform for multi platform forensic analysis tasks, allowing it to take it vantage of the many many Linux tools available. The challenges are foreseeable, you have Linux artifacts, now commingled on a Windows platform, which makes forensic analysis that much more difficult when examining such a system as evidence. This week I'm going to break down the linux subsystems for forensic investigators…

DFSP # 392 - Simulation Training Aug 22, 2023

This week I'm going to talk about tabletop exercises as part of a security training program. I feel that there is too much focus on technical skill training and not enough focus on actual incident management training in the industry. There are plenty of highly skilled professionals that can do DFIR work… However, a roadblock, many organizations and practitioners encounter is in the struggle of how to actually implement their knowledge and skills for a security incident response investigation within a specific organization. They may know what to do, but there are many challenges in identifying actually how to do it when the time comes. I will share my thoughts on how to improve your security program through simulation training…

DFSP # 391 - Investigation Lifecycle Aug 15, 2023

This week I'm talking about The NIST (National Institute of Standards and Technology) investigation lifecycle. The NIST investigation lifecycle encompasses a series of well-defined steps, starting from problem identification and scoping, through data collection and analysis, to the formulation of conclusions and recommendations. This comprehensive framework ensures that investigations conducted by NIST are rigorous, unbiased, and provide reliable results that can be used to inform decision-making, improve practices, and promote innovation across a wide range of disciplines. More about it...

DFSP # 390 - SSH Triage Aug 08, 2023

This week I'm talking about linux forensic triage strategy. In particular, I'm covering SSH. SSH traffic comes up in many different types of investigations. For that reason, it is a common and standard artifact every examiner should be familiar with. I will provide you the artifact background and the triage strategy…..

DFSP # 389 - $Usnrl Aug 01, 2023

The USN Journal, also known as the Update Sequence Number Journal, is a feature of the Windows operating system that serves as a record of changes made to files and directories on a disk volume. It provides valuable information and insights into file system activities, which can aid investigators in reconstructing events, understanding system behavior, and uncovering evidence. This week I break down the artifact from a DFIR point of view provide triage strategy.....

DFSP # 388 - Web 3.0 Talk with SUMURI Jul 25, 2023

This week Jason Roslewicz from SUMURI returns for some web 3.0 and virtual reality talk.

DFSP # 387 - Network Share Modifications Jul 18, 2023

This week I talk about adding, modifying, and removing network shares through the lens of detecting lateral movement.

DFSP # 386- The Three Task Hosts Jul 11, 2023

This week I break down the three Windows task hosts from a DFIR point of view.

DFSP # 385 - Network Share Access Jul 04, 2023

This week I talk about network share access events and lateral movement detection.

DFSP # 384 - Cloud Talk with SUMURI Jun 27, 2023

This week Jason Roslewicz from SUMURI returns for some cloud talk.

DFSP # 383 - WMI Exploitation Jun 20, 2023

This week I talk about the exploitation of the Windows Management Instrumentation application.

DFSP # 382 - Protocol Buffers Jun 13, 2023

This week Chris Currier and I talk about mobile forensics and protocol buffers.

DFSP # 381 - Spoliation Jun 06, 2023

This week I cover Windows events commonly associated with data spoliation and insider threats.

DFSP # 380 - Ransomware Talk with SUMURI May 30, 2023

This week Jason Roslewicz from SUMURI returns for some ransomware talk.

DFSP # 379 - New Process Creation May 23, 2023

This week I Cover my all-time favorite Windows event, security event 4688: new process creation. If you do windows, incident, response, forensics, this is a must-know know artifact.

DFSP # 378 - SVCHOST Revisited May 16, 2023

This week I talk about SVCHOST; how it fits into the Windows operating system, and how to think about it from a DFIR point of view.

DFSP # 377 - Interview with Yugal Pathak May 09, 2023

This week I talk with Interview with Yugal Pathak about organizational forensic readiness.

DFSP # 376 - Zero-Day and DFIR May 02, 2023

This week I talk about the role and typical responsibilities DFIR professionals may be called up to take to assist with a zero-day response.

DFSP # 375 - More AI with SUMURI Apr 25, 2023

This week Jason Roslewicz from SUMURI returns to talk more about AI issues.

DFSP # 374 - SRUM Apr 18, 2023

This week I break down the Windows System Resource Usage Monitor from a DFIR point of view.

DFSP # 373 - Linux File Poisoning Apr 11, 2023

This week I cover some malware detection methods for Linux.

DFSP # 372 - Windows Processes Apr 04, 2023

This week I talk about different ways to approach windows process triage. There are so many processes, especially in enterprise environments, having a standard approach that is fast and effective is key for security incident response.

DFSP # 371 - AI with SUMURI Mar 28, 2023

This week Jason Roslewicz from SUMURI shares his insights about the impact of artificial intelligence and provides advice for navigating through changing times.

DFSP # 370 - UserAssist Mar 21, 2023

This week is a Windows artifact breakdown on a common source of evidence.

DFSP # 369 - Linux Malware Mar 14, 2023

This week I cover malware on Linux file systems for new examiners.

DFSP # 368 - SVCHOST Mar 07, 2023

This week is a guide to understanding SVCHOST from a DFIR point of view. It is one of the most abused Windows processes, and having a firm working knowledge for investigations is essential.

DFSP # 367 - Shimcache Amcache Feb 28, 2023

This week is a Windows artifact breakdown on a common source of evidence.

DFSP # 366 - Linux File System Feb 21, 2023

This week I cover the Linux file system for new examiners.

DFSP # 365 - CVSS Triage Feb 14, 2023

This week I breakdown the elements within a standard CVSS report for fast triage application.

DFSP # 364 - Network Triage Feb 07, 2023

This week I talk about how to triage Windows events for network connection activity.

DFSP # 363 - RDP Forensics Jan 31, 2023

This week I talk about how to approach investigations involving remote desktop connections.

DFSP # 362 - Windows Core Processes Jan 24, 2023

This week I talk about Windows core processes from a DFIR point of view.

DFSP # 361 - Powershell Breakdown Jan 17, 2023

This week I talk about Powershell attack IOCs.

DFSP # 360 - Permitted Events Jan 10, 2023

This week I talk about how to triage Windows events for network connection activity.

DFSP # 359 - Career Checkpoint Jan 03, 2023

This week is my annual career assessment review - or, my guidelines of how to evaluate your past performance and your future goals.

DFSP # 358 - Listening Ports Dec 27, 2022

This week I talk about how to triage Windows events for network listening activity.

DFSP # 357 - EVTX Analysis Dec 20, 2022

This week I talk about an approach for reviewing Windows event logs.

DFSP # 356 - CMD Triage Dec 13, 2022

This week I talk about an approach for reviewing CMD syntax for findings.

DFSP # 355 - Network Triage Dec 06, 2022

This week I talk about essential network basics necessary for triage.

DFSP # 354 - Fast Triage Nov 29, 2022

This week I talk about Webshell forensics.

DFSP # 353 - Webshells Nov 22, 2022

This week I talk about Webshell forensics.

DFSP # 352 - Startup Locations Nov 15, 2022

This week I talk about Windows startup locations.

DFSP # 351 - Prefetch Nov 08, 2022

This week I talk about Windows Prefetch forensics.

DFSP # 350 - Linux Fileless Attacks Nov 01, 2022

This week I talk about fileless attacks Linux systems.

DFSP # 349 - Registry Modification Events Oct 25, 2022

This week I talk about how to find evidence of malicious autoruns in the windows registry using Windows event codes.

DFSP # 348 - Root Cause Oct 18, 2022

This week I talk about strategies to determine root cause early during an investigation.

DFSP # 347 - Weblogs Oct 11, 2022

This week is a breakdown of HTTP log forensic triage.

DFSP # 346 - Masquerading Oct 04, 2022

This week I talk about finding evidence of Kernel file masquerading on Linux systems.

DFSP # 345 - AutoRuns Sep 27, 2022

This week I talk about how to find evidence of malicious autoruns in the windows registry.

DFSP # 344 - Mac Spotlight DB Sep 20, 2022

This week I talk about the forensic value of the Apple Spotlight DB.

DFSP # 343 - Registry aka The Dungeon Maze Sep 13, 2022

When you talk autoruns you must talk about the Windows registry. This artifact is very dense and it may be difficult to zero in on the elements that are important for compromise assessment. Given that, I am going to begin the series with a breakdown of the Windows Registry from a DFIR point of view. This is crucial in understanding ...

DFSP # 342 - FLUX It Sep 06, 2022

This week I talk about the attack methodology known as Fast Flux.

DFSP # 341 - Those other taskers Aug 30, 2022

This week’s focus is on other scheduled task events useful for DFIR triage.

DFSP # 340 - PSEXEC, ready or not Aug 23, 2022

This week I talk about a popular Windows utility attackers often exploit.

DFSP # 339 - That SUDO that you do Aug 16, 2022

This week I breakdown the SUDOERS file for forensic triage.

DFSP # 338 - Taskers Aug 09, 2022

This week’s focus is on new scheduled tasks, which are a common way of establishing longevity on system. I will have my breakdown of the artifact and how to interpret it for fast analysis coming up….

DFSP # 337 - ResponderCon Aug 02, 2022

The must-attend event for Cyber First Responders who must detect and deal with ransomware, zero-day events, and more!

DFSP # 336 - BAM! Jul 26, 2022

This week I talk about the Windows Background Activity Monitor, an artifact that may be used to find evidence of execution.

DFSP # 335 - CRON Jul 19, 2022

This week I breakdown CRON for the uninitiated.

DFSP # 334 - Service Changes Jul 12, 2022

This week is about persistence artifacts. Namely the records for when services fail to start, are either started or stopped, have crashed have had their start type changed. Since services are one of the common ways attackers achieve persistence, understanding how these events may be used for triage purposes is very important...

DFSP # 333 - Mac Autoruns Jul 05, 2022

This week I talk Mac autoruns.

DFSP # 332 - Bash Histories Jun 28, 2022

This week is about bash history forensics.

DFSP # 331 - New Services Jun 21, 2022

In the past I’ve talked about fast triage from a high-level, addressing the different artifacts and some interesting elements in each of those artifacts. I decided to start going a bit deeper and focus on one or a few artifacts at a time and really talk about the important details they may record for your investigation and how to interpret that information quickly. I’m going to start with the New Service Installation details recorded in Windows event logs. These have a number of advantages for your triage methodology and I will have all the details coming up.

DFSP # 330 - Certifications Jun 14, 2022

Every so often I like to revisit certifications. Everyone seems to have their own opinion as to the value of one certification over another, whether or not certifications should carry as much weight as they do, or preference of certain certifications over others, and so on. In this episode I’m sharing my thoughts on the topic as well as how I would approach certifications if I were new in the field but also retained everything I have learned over the years about the impact certifications have or can have on your career.

DFSP # 329 - Shellbags Jun 07, 2022

This week is a back to basics episode where I cover Windows shell bags. This is a core Windows artifact that gets included in pretty much every file use and knowledge investigation. Any investigation where you’re looking to tie a specific account to directory access activity. Like most Windows artifacts you must know how user interaction affects the artifact in order to properly interpreted as evidence and you must also be aware of any caveats or pitfalls that may affect your evidence. Spoiler alert, there is a huge one associated with Windows shell bags that I’ll cover at the end of the episode-it’s nothing new but if you’re unfamiliar with it you definitely need to know about it.

DFSP # 328 - Linux Executables May 31, 2022

If you are accustomed to Windows forensics you may find you have to shift your way of thinking about executables when you are dealing with a Linux system. Unlike Windows, in Linux there is no fixed file extension to designate an executable. Everything on a Linux system of the file and any file can be executable, so where do you even begin? In this episode I am going to address how to approach Linux executables to help those newer to Linux exams deal with the nuances.

DFSP # 327 - Persistence Part 1 May 24, 2022

One of the first things attackers attempt to accomplish on a compromised system is to establish persistence. Unless you are dealing with a denial of service attack, most other attacker goals are centered on maintaining the degree of control over a compromise system in order to use system resources for things like cryptomining or to maintain a foothold to further an attack strategy. This week I am going to talk about a fast triage methodology for persistence, which is one of the first triage strategies I normally recommend for a compromise assessment. Because I am focusing on a fast triage methodology I am going to focus on the artifacts most examiners will have readily at hand and how to make the most of them during the initial pass.

DFSP # 326 - MFT May 17, 2022

This week I’m covering the Master file table as a core forensic artifact for Windows investigations. This artifact has value is both a primary and secondary artifact and offers opportunity to decode evidence in a number of different situations. In this episode I’m covering the forensic basics, some use cases and tools you can use to bring the value of the artifact to its full potential.

DFSP # 325 - Malware Triage Part 2 May 10, 2022

This week of talking malware fast triage. These are the techniques that are short of malware reverse engineering and allow analysts to identify malware and also get a sense of what it is does. This is a necessary skill set for all DFIR professionals as you typically deal with malware and you need a way to do some basic forensics on it for context to advance your investigation. This is going to be a two-part episode where I first go over the foundational information you need to have four common malware triage tasks and the second part will go over specific methods, tools, and indicators for different types of artifacts.

DFSP # 324 - Malware Triage Part 1 May 03, 2022

This week of talking malware fast triage. These are the techniques that are short of malware reverse engineering and allow analysts to identify malware and also get a sense of what it is does. This is a necessary skill set for all DFIR professionals as you typically deal with malware and you need a way to do some basic forensics on it for context to advance your investigation. This is going to be a two-part episode where I first go over the foundational information you need to have four common malware triage tasks and the second part will go over specific methods, tools, and indicators for different types of artifacts.

DFSP # 323 - SRUM Apr 26, 2022

This week I’m talking about SRUM, a Windows artifact that you don’t hear that much about. It has a lot of great potential as evidence and it is something worth the time to check it out and see how it fits into your daily DFIR work.

DFSP # 322 - Live evidence integrity Apr 19, 2022

This week is some thoughts on live evidence integrity. Years ago evidence validation was fairly standard with few exceptions. Nowadays it’s more of a challenge when considering live evidence collections either on scene, remotely or even in lab environments where physical level access to your evidence is becoming more the exception. It is something that needs to be part of your collection process as it may impact the reliability of your results.

DFSP # 321 - URL Leaks Apr 12, 2022

This week I will talk about investigating data spill cases involving exposed URLs. This is a typical privacy investigation many incident response teams handle and I thought it would be useful to go over some standard guidelines for handling such cases. To be effective with these investigations you need to know how to determine liability and responsibility, a little Google foo, and a number of odds and ends concerning mitigation, containment and remediation strategies depending on what you are dealing with.

DFSP # 320 - Lateral MM and Event Logs Apr 05, 2022

This week I’m going to cover detecting lateral movement using Windows event logs. This is not the Windows fast triage method I covered in previous episodes. This is more in-depth and focuses on specific attack tools and strategies seen in actual cases. Going into this level of detail is beyond the scope of a typical episode, however there is some research that has very granular details on the tools and methods you can use. I’ll have that coming up right after this.

DFSP # 319 - Shellbags Mar 29, 2022

This week is a back to basics episode where I am going to cover Windows shellbags. This is a core Windows artifact that gets included in pretty much most every file use and knowledge investigation or any investigation where you’re looking to tie a specific account to directory access activity. Like most Windows artifacts you must know how user interaction affects the artifact in order to properly interpreted it as evidence. You must also be aware of any caveats or pitfalls that may affect your evidence. Spoiler alert, there is a huge one associated with Windows shellbags that I’ll cover at the end of the episode-it’s nothing new but if you’re unfamiliar with it you definitely need to know about it.

DFSP # 318 - Rust and Chainsaw Mar 22, 2022

This week I am talking about a program language called rust and the advantages it has for DFIR analyst. I’m also covering Chainsaw, a toolset that you can use for Windows event log analysis.

DFSP # 317 - UserAssist Mar 15, 2022

This week it’s back to basics with a Windows artifact for tracking program execution. I’m covering the user assist key which is a mainstay for both live triage and dead box forensics. This artifact is useful for profiling system usage, identifying malware, and general file use and knowledge applications. There are some caveats you need to be aware of and in this episode I’m covering five different experiments to document the effects that different types of user activity had on the artifact. If you want to better understand this artifact and how to work with it stay tuned.

DFSP # 316 - Cloud Traffic Security Mar 08, 2022

This week I am covering how different common protocols are secured in the cloud. Part of your effectiveness as a security analyst is your knowledge and understanding of how environments work in a typical scenario. I know that all environments are different but there is some foundational knowledge that you can learn that will be useful no matter what environment you’re working. My goal with this episode is to provide you with a better understanding of how insecure protocols are handled in cloud environments.

DFSP # 315 - ARTHIR Mar 01, 2022

This we can talk about Arthir, an open source platform for windows incident response and threat hunting.

DFSP # 314 - Future of Cyber Security Feb 22, 2022

This week Max Lamothe-Brassard talks about the future of cyber security.

DFSP # 313 - Shimcache and Amcache Feb 15, 2022

This week is a back to basic episode featuring Shimcache and Amcache. Learn what they are, why they are important to many investigations and the pitfalls to avoid.

DFSP # 312 - Cloud Network Security Services Feb 08, 2022

This week is about Cloud Network Security Services.

DFSP # 311 - Data Spoliation Fast Triage Feb 01, 2022

This week we continue with the Windows fast triage series and talk about data spoliation detection.

DFSP # 310 - Cloud Network Segmentation Jan 25, 2022

This week is about cloud network segmentation. Network segmentation has security advantages, and that’s regardless of whether or not security is the intention. There are some big differences between traditional on-prem network segmentation and cloud infrastructure segmentation. As a DFIR practitioner, knowing the difference is vital for your incident response preparedness. This week I will break it down from a DFIR point of view and provide some necessary insight that will help you better structure your investigations involving cloud assets.

DFSP # 309 - Insider Threats Jan 18, 2022

This week I cover insider threat, which is sort of a gray area between traditional investigations and DFIR investigations.

DFSP # 308 - Cloud Access Controls Jan 11, 2022

This week I’m talking about identity access controls commonly encountered in cloud environments. These come up during DFIR investigations and high-level awareness, at the least, is necessary for analysts in order to be effective during investigations. These are the things that may be part of root cause, part of the attack escalation, or part of mitigation will remediation. This week all cover the basics to help with your incident response preparedness.

DFSP # 307 - Career Strategy Checkup Jan 04, 2022

This week is my advice for conducting a career critique as well as to plan for the future - or at least for 2022. I do this episode every year at this time with the intention of helping newer analysts maximize their efforts to achieve the desired career goals in both the short term and long term.

DFSP # 306 - Lateral MM Fast Triage 5 Dec 28, 2021

This week we continue with the Windows fast triage series and talk about lateral movement evidence that may be found in DC records.

DFSP # 305 - CSA Cloud Threats 8 Dec 21, 2021

This week is a continuation of the threats to cloud computing miniseries. We are stepping through the top 11 threats to cloud computing as identified by the Cloud Security alliance. When you are protecting cloud assets or investigating breaches of cloud assets, there is a lot to keep in mind. You must remember the standard security infrastructure, the new cloud infrastructure as well as any changes to the standard infrastructure that could be affected for your investigation. The top 11 threats to cloud computing help identify where you, as an analyst, should prioritize your time both as a starting point and how you use your limited time for continuing education.

DFSP # 304 - Detecting File Poisoning on Linux Dec 14, 2021

This week I review a great method to detect file poisoning on Linux using all native commands.

DFSP # 303 - Mac Artifacts with SUMURI Dec 07, 2021

This week SUMURI's Steve Whalen (a.k.a. 'MacBoy') talks Mac artifacts

DFSP # 302 - Lateral MM Fast Triage 4 Nov 30, 2021

This week we continue with the Windows fast triage series and talk about lateral movement evidence that may be found in logon event records.

DFSP # 301 - OSDFCON 2021 Nov 23, 2021

This week Brian Carrier of Basis Technology joins me to talk about OSDFCon. The DFIR community relies on open source tools and the conference is a great way to get exposure to new tools and to learn how to use them. There's a great lineup this year with something for everyone. Registration is free for everyone.

DFSP # 300 - Case Study Ocean Lotus Nov 16, 2021

This week is a case study where we look at an actual attack strategy and compared it against standard triage methods to see how well they hold up. In this episode I break down some attack methods attributed to APT32, also known as Ocean Lotus, and we’ll see how standard triage techniques hold up against the attack chain.

DFSP # 299 - Malicious Powershell with Blumira Nov 09, 2021

Amanda Berlin of Blumira speaks on malicious Powershell attacks and defense techniques.

DFSP # 298 - Mac Forensics with SUMURI Nov 02, 2021

This week SUMURI's Steve Whalen (a.k.a. 'MacBoy') talks Mac forensics.

DFSP # 297 - Nested Groups Oct 26, 2021

This week I’m talking about Nested Groups and the risk they pose for security. Built-in to the functionality of Active Directory is the ability to attach a group to another group. While this has advantages for account administration across an organization, it also offers attackers opportunity if certain precautions are not taken. This week I’ll break down Nested Groups in DFIR terms, talk about how attackers take advantage of it and what analysts need to know for investigations.

DFSP # 296 - Case Study Turla-Comrat Oct 19, 2021

This week is a case study where we look at an actual attack strategy and compared it against standard triage methods to see how well they hold up. The Turla group using ComRat malware is our case example, let’s see if standard triage techniques can save the day.

DFSP # 295 - Ransomware with Blumira Oct 12, 2021

Matt Warner, Blumira CTO and Co-Founder, talks ransomware investigations.

DFSP # 294 - CSA Cloud Threats 7 Oct 05, 2021

This week is a continuation of the threats to cloud computing miniseries. We are stepping through the top 11 threats to cloud computing as identified by the Cloud Security alliance. When you are protecting cloud assets or investigating breaches of cloud assets, there is a lot to keep in mind. You must remember the standard security infrastructure, the new cloud infrastructure as well as any changes to the standard infrastructure that could be affected for your investigation. The top 11 threats to cloud computing help identify where you, as an analyst, should prioritize your time both as a starting point and how you use your limited time for continuing education.

DFSP # 293 - Case Study: Ransomware Sep 28, 2021

This week is a case study that demonstrates how fundamental DFIR triage methods can detect advanced attacks. Examiners, especially newer examiners, should find confidence in the fact that standard triage techniques have such a powerful impact on security investigations.

DFSP # 292 - Top Cloud Threats with Blumira Sep 21, 2021

This week Nato Riley from Blumira pays a visit to talk about the top threats to cloud computing.

DFSP # 291 - Lateral MM Fast Triage 3 Sep 14, 2021

This week we continue with the Windows fast triage series and talk about lateral movement evidence that may be found in admin shares event records. Four different types of logs are covered, each containing different information for triage purposes.

DFSP # 290 - Mac Training with SUMURI Sep 07, 2021

This week SUMURI's Steve Whalen (a.k.a. 'MacBoy') and Dave Melvin talk about the latest in Mac training and certification. Learn the advantages of vendor neutral training and how to prioritize it in your own training regiment.

DFSP # 289 - Framing Root Cause Aug 31, 2021

As an analyst, it is important to identify root cause and link it back to security governance strategies. This is dealt with through root cause statements typically. What exactly should you be doing for a root cause statement? How important is it? If you produce a findings report you can count on the root cause statement being read. Other parts of the document may be skimmed through, or even ignored, but the root cause statement is going to draw the attention of a variety of different audiences. Therefore this is something you want to get right. In this episode I’m going to deliver a simple approach you can use.

DFSP # 288 - Max DFIR Impact Aug 24, 2021

Most of my episodes are about computer forensic artifacts and methods. Once in a while I like to cover non-technical topics, such as thoughts and recommendations about career development, subject matter expertise strategies, and impact exposure or delivery of your work. These soft skills are important to your career success. So this week will be on maximizing DFIR exposure in your current role, whatever that role may be. I will cover how to connect the work you do with the high-level strategies that are important to your management or your customers.

DFSP # 287 - CSA Cloud Threats 6 Aug 17, 2021

This week is a continuation of the threats to cloud computing miniseries. We are stepping through the top 11 threats to cloud computing as identified by the Cloud Security alliance. When you are protecting cloud assets or investigating breaches of cloud assets, there is a lot to keep in mind. You must remember the standard security infrastructure, the new cloud infrastructure as well as any changes to the standard infrastructure that could be affected for your investigation. The top 11 threats to cloud computing help identify where you, as an analyst, should prioritize your time both as a starting point and how you use your limited time for continuing education.

DFSP # 286 - Lateral MM Fast Triage 2 [5145] Aug 10, 2021

This week we continue with the Windows fast triage series. We are up to lateral movement and talking about admin shares. On topic this week is event 5145 which is a Windows log that records verbose information about network share objects and it is an artifact you can use to triage a system or group of systems for evidence of malicious lateral movement.

DFSP # 285 - Linux Malware Triage Aug 03, 2021

This week I wanted to take a break from Windows forensics and talk about Linux malware triage. The Linux platform offers forensic analysts the opportunity to do a very decent job performing malware triage. What I mean by this is that you do not need any special tools installed, all you essentially need is the knowledge of a handful of commands in the ability to make sense of the output. Armed with this, any analyst can do a malware triage quickly and efficiently.

DFSP # 284 - Fast Triage case study: non-Windows core processes Jul 27, 2021

This week we’re going to take a look at how standard triage methodology can detect advanced attack techniques. Even as a newer examiners, if you learn the standard triage methods that I have covered in the fast triage series, you will find the skills provide ample opportunity to detect all sorts attack activity-even very advanced attack activity. This is because there are natural chokepoints in the attack chain that can be used to your advantage. This week we are going to see the non-Windows core process triage in action through the lens of a very advanced attack dubbed “operation ghost.”

DFSP # 283 - CSA Cloud Threats 5 Jul 20, 2021

This week we take another look at the top threats to cloud computing. On tap This week is account hijacking. All analysts working in the DFIR field today must be aware of threats to cloud computing in order to be effective in their roles.

DFSP # 282 - Lateral MM Fast Triage Jul 13, 2021

This week I talk about lateral movement fast triage. This is the next topic in the Windows fast triage miniseries and it aligns with the goal of the entire series, which is to help new or any analyst identify the most accessible artifacts that may be quickly analyzed to find evidence of compromise. So far we have dealt with persistence, suspicious network activity, and suspicious processes. As always, I will provide a simple yet effective approach to work with lateral movement artifacts.

DFSP # 281 - Fast Triage case study: persistence Jul 06, 2021

This week I’m doing another walk-through to illustrate how standard triage methodology can detect advanced attack techniques. Sometimes as a newer examiner, it’s easy to become overwhelmed with the technical detail necessary to understand and attack. It’s also easy to become discouraged and convince yourself that it’s way too complicated for your current skill set and you may not even feel useful as a team member. This episode is going to dispel all of that and show you how a focus on the standard fast triage method provides all the knowledge you need to detect and advanced breach into an environment.

DFSP # 280 - Malware Fast Triage Jun 29, 2021

This week I’m covering malware fast triage. It occurred to me that I should revisit this issue for a couple of different reasons. I remember covering this many years ago and I believe that’s why I haven’t thought about doing anything on it lately. However, it does go hand-in-hand with the Windows fast triage series that I am doing. Part of that strategy is to look for “common malware patterns.” In an effort to maximize what the listeners get from the episodes I figured this topic definitely needs to be revisited so that when I use that term, you are at least clear on what I mean by it and the method it represents.

DFSP # 279 - CSA Cloud Threats 4 Jun 22, 2021

This week is about the top threats to cloud computing.

DFSP # 278 - Process Triage & CMD Jun 15, 2021

This week is a continuation of the Windows fast triage miniseries. While other aspects of the triage miniseries had fairly contained artifacts to examine, new process triage presents a large and complex landscape to the analyst. I have already broken down a number of effective analysis methods to make this more manageable. This week I focus on key applications to look for during a review. These applications tend to be associated more with malicious activity, at least according to threat intelligence research, so being aware of them and recognizing the potential is important. I also spend some time talking about the nuances of CMD.

DFSP # 277 - Learning from the Red Team II Jun 08, 2021

A while back I did an episode on “learning from the red team” which focused on methods blue team members can utilize to better understand attacks and the artifacts affected by those attacks. One of the advantages of this method that I did not mention in that episode was how to use open source vulnerability scanners for the same purpose. This week, will be part two and I will go over freely available resources and the method to help you gain better insight into forensic artifacts.

DFSP # 276 - CVSS Fast Analysis Jun 01, 2021

This week is about how size up a reported vulnerability quickly.

DFSP # 275 - dotNET May 25, 2021

This week I tackle .NET. It is an ecosystem that is associated with malicious Powershell activity.

DFSP # 274 - Powershell Revisited May 18, 2021

This week I revisited powershell from a process fast triage context.

DFSP # 273 - CSA Cloud Threats 3 May 11, 2021

This week is about the top threats to cloud computing.

DFSP # 272 - 4688 May 04, 2021

This week I continue with the fast triage method for processes with a focus on historical records.

DFSP # 271 - DREAD and STRIDE Apr 27, 2021

This week I cover threat modeling from a DFIR point-of-view. It provides a standard framework to classify and rate the severity of vulnerabilities discovered during investigations.

DFSP # 270 - CAPEC Apr 20, 2021

This week I run through a threat intel resource you may use for standardized attack information.

DFSP # 269 - Svchost Revisited Apr 13, 2021

This week I revisit Svchost and the triage methods to apply.

DFSP # 268 - CSA Cloud Threats 2 Apr 06, 2021

This week is about the top threats to cloud computing.

DFSP # 267 - Sunscreen Mar 30, 2021

This week is a case study that demonstrates the power behind IR fundamental methodology.

DFSP # 266 - Windows non-core processes Mar 23, 2021

This week I continue with the fast triage method for processes with a focus on, well, everything else!

DFSP # 265 - CSA Cloud Threats 1 Mar 16, 2021

This week is about the top threats to cloud computing.

DFSP # 264 - Golden SAML Mar 09, 2021

This week is about preparing for Golden SAML attacks for both Incident Response and Threat Hunting.

DFSP # 263 - Threat Hunt with Statistics Mar 02, 2021

This week is about applying basic statistical analysis to threat hunting. The results are effective!

DFSP # 262 - Security Theatre Feb 23, 2021

This week is about theatrics in security and how to avoid the trap.

DFSP # 261 - Wincore Processes Revisited part 2 Feb 16, 2021

This week I revisit Windows Core Processes and the triage methods to apply to them.

DFSP # 260 - Learn from the Red Team Feb 09, 2021

This week I talk about vulnhub, a free resource to practice ethical hacking skills and sharpen your DFIR skills.

DFSP # 259 - Wincore Processes Revisited part 1 Feb 02, 2021

This week I revisit Windows Core Processes and the triage methods to apply to them.

DFSP # 258 - Network Triage Part 4 Jan 26, 2021

This week is the fourth part of the Network-Fast-Triage mini-series. In this installation I cover triage techniques for Windows event logs that record blocked network activity.

DFSP # 257 - Supply Chain Attacks Jan 19, 2021

This week is about supply chain security posture from a DFIR point-of-view.

DFSP # 256 - Kernel Process Masquerading Jan 12, 2021

This week I go over a method to detect kernel process masquerading on Linux systems.

DFSP # 255 - The Worship of Intelligence in Tech Jan 05, 2021

This week I interview author Shawn Livermore about the myth of the "tech-genius."

DFSP # 254 - Network Triage Part 3 Dec 29, 2020

This week is the third part of the Network-Fast-Triage mini-series. In this installation I cover triage techniques for Windows event logs that record network port-binding.

DFSP # 253 - Network Triage Part 2 Dec 22, 2020

This week is the second part of the Network-Fast-Triage mini-series. In this installation I cover triage techniques for Windows event logs that record network connections.

DFSP # 252 - Werfault Dec 15, 2020

This week I cover triage techniques for werfault.exe. The process does not have the best documentation which makes it a challenge to triage.

DFSP # 251 - The Rise of Crypto SIM Swapping Dec 08, 2020

This week I interview Haseeb Awan, CEO of EFANI, about the rise of SIM swapping attacks. Haseeb explains the attack, how attackers carry it out, and provides some mitigation strategies.

DFSP # 250 - Network Triage Part 1 Dec 01, 2020

This week is the first part of the Network-Fast-Triage mini-series. The first installation is the network investigation primer.

DFSP # 249 - Linux Fileless Attacks Nov 24, 2020

This week I go over a method to detect fileless malware on Linux systems.

DFSP # 248 - Searchsploit Nov 17, 2020

This week I talk utilizing the ExploitDB for DFIR investigations. Searchsploit is a command line search tool for Exploit-DB that allows you the power to perform detailed off-line searches through your locally checked-out copy of the repository. This capability is particularly useful for security assessments on segregated or air-gapped networks without Internet access.

DFSP # 247 - Startup Locations Nov 10, 2020

This week is the last part of the Persistence-Fast-Triage mini-series. The final installation covers Windows startup locations.

DFSP # 246 - Investigation Lifecycle Nov 03, 2020

This week I talk about the IR Investigation Lifecycle, or, the elements included within the incident handling process to ensure a complete investigation.

DFSP # 245 - Fetch and Execute Oct 27, 2020

This week I talk about the use of RUNDLL32 to exploit information files (.INF) to "fetch and execute" malware.

DFSP # 244 - Registry Persistence Part 3 Oct 20, 2020

This week is part 3 of examining the Windows Registry for evidence of persistence and the focus is on Windows Registry Modification Event Records.

DFSP # 243 - Stomping the Clock Oct 13, 2020

This week I talk about detecting time stomping on Windows and Linux systems.

DFSP # 242 - Registry Persistence Part 2 Oct 06, 2020

This week I talk about examining the Windows Registry for evidence of persistence.

DFSP # 241 - Forensic Hardware Sep 29, 2020

This week I interview JASON ROSLEWICZ of SUMURI about the hardware that drives your forensics system.

DFSP # 240 - MDM Sep 22, 2020

This week is part 3 of the Mobile Attack series.

DFSP # 239 - Registry Persistence Part 1 Sep 15, 2020

This week I talk about examining the Windows Registry for evidence of persistence.

DFSP # 238 - Bash Attacks Sep 08, 2020

This week I talk about the use of Bash commands in crypto-mining attacks.

DFSP # 237 - Attack Shimming Sep 01, 2020

This week I talk about detecting persistence via Attack Shimming artifacts.

DFSP # 236 - Apple FSEvents Aug 25, 2020

This week I interview Steve Whalen of SUMURI about Apple FSEvent artifacts. Learn what they are and how to leverage them for investigations.

DFSP # 235 - Scheduled Task Change Aug 18, 2020

This week I talk about examining Windows Scheduled Task change events for evidence of persistence.

DFSP # 234 - Divide & Conquer with Brian Carrier Aug 11, 2020

This week I interview Brian Carrier, SVP & CTO of Basis Technology about his "Divide & Conquer" approach to DFIR investigations.

DFSP # 233 - New Scheduled Tasks Aug 04, 2020

This week I talk about examining Windows New Scheduled Task events for evidence of persistence.

DFSP # 232 - Exam Process - Soup-to-Nuts Jul 28, 2020

This week Chris of MSAB shares his recommended process for DFIR exam standardization.

DFSP # 231 - Service Change Triage Jul 21, 2020

This week I talk about examining Windows Service modification events for evidence of persistence.

DFSP # 230 - User Activity Artifacts Jul 14, 2020

This week I talk about the artifacts and methodology for examining user activity on Windows systems.

DFSP # 229 - Mobile Attacks Part 2 Jul 07, 2020

This week is part 2 of the Mobile Attack series.

DFSP # 228 - Psychology of Reporting Jun 30, 2020

This week I interview Steve Whalen of SUMURI and we talk about effective ways to report forensic findings.

DFSP # 227 - New Service Triage Jun 23, 2020

This week I talk about examining Windows systems for evidence of persistence.

DFSP # 226 - User Logons Jun 16, 2020

This week I talk about a triage methodology for examining user activity.

DFSP # 225 - Mobile Device Attacks Jun 09, 2020

This week I talk about mobile device compromise.

DFSP # 224 - Conhost Forensics Jun 02, 2020

This week I talk about examining Conhost data for evidence of execution.

DFSP # 223 - Apple Meta May 26, 2020

This week I interview Steve Whalen of SUMURI about Apple metadata.

DFSP # 222 - User Enumeration May 19, 2020

This week I talk about a triage methodology for examining suspicious user accounts.

DFSP # 221 - Mobile Device Security May 12, 2020

This week I talk about mobile device operating system and file system security, focusing specifically on applications.

DFSP # 220 - Mobile Forensics For New Investigators May 05, 2020

This week I interview MSAB instructor Chris Currier about mobile forensics for new examiners.

DFSP # 219 - Forensic Grab Bag Apr 28, 2020

This week I talk about persistence, malware analysis and identifying system owners.

DFSP # 218 - Plaso & Elk Timelines Apr 21, 2020

This week I talk about SOF-ELK to take your timelines to a new level

DFSP # 217 - Static Malware Analysis Apr 14, 2020

This week I talk about CFF Explorer.

DFSP # 216 - DHASH Apr 07, 2020

This week I talk with MSAB about DHASH, learn what it is and its use in DFIR investigations

DFSP # 215 - CMSTP Forensics Mar 31, 2020

This week I cover triaging CMSTP for remote execution

DFSP # 214 - CyberChef Mar 24, 2020

This week I explain why you need CyberChef in your toolbox

DFSP # 213 - Trusted Developer Utilities Mar 17, 2020

This week I talk DFIR triage for Microsoft Trusted Dev Utilities

DFSP # 212 - Learning Python Mar 10, 2020

This week I review resources aimed at teaching you Python

DFSP # 211 - Mac Forensics with Steve Whalen Mar 03, 2020

This week I interview Steve Whalen from SUMURI about the current Mac Forensic landscape

DFSP # 210 - Pivot Tables for Forensics Feb 25, 2020

This week I talk about Pivot Tables and their value for DFIR investigations

DFSP # 209 - Mac Autoruns Feb 18, 2020

This week I talk about common autorun locations to check during Mac exams

DFSP # 208 - Persistence Fast Triage Feb 11, 2020

This week I talk about a fast triage methodology to detect persistence on Windows systems

DFSP # 207 - Forensic Grab Bag Feb 04, 2020

This week I talk about tools available on the SIFT workstation... that you may not know or even there!

DFSP # 206 - Certutil Abuse Jan 28, 2020

This week I talk breakdown certutil exploitation; what it is and methods to detect malicious usage

DFSP # 205 - Layered Drivers Jan 21, 2020

This week I talk about using layered drivers as an artifact to identify persistence

DFSP # 204 - SOF ELK Jan 14, 2020

This week I talk about SOF ELK, a freely available pre-built virtual appliance for DFIR work

DFSP # 203 - Profile of a modern analyst Jan 07, 2020

This week I start the year with my traditional "back-to-basics" episode, focusing on self-improvement themes and goals to consider

DFSP # 202 - Base64 Forensics Dec 31, 2019

This week I talk about dealing with Base64 evidence.

DFSP # 201 - Regsvcs Triage Dec 24, 2019

This week I talk about identifying REGSVC \ REGASM abuse

DFSP # 200 - Audit Log Clearing Dec 17, 2019

This week I talk about different types of audit log clearing and detection strategies

DFSP # 199 - Hashdeep Dec 10, 2019

This week I talk about using Hashdeep for forensic triage

DFSP # 198 - Linux Malware Detect Dec 03, 2019

This week I talk about LMD, an openly available tool to increase Linux security posture.

DFSP # 197 - Approaching Network Forensics Nov 26, 2019

This week I talk about network forensic methodology.

DFSP # 196 - autoLLR Nov 19, 2019

This week I talk about autoLLR, a script to automate evidence collection on live Linux systems as well as artifact post processing.

DFSP # 195 – BAM! Nov 15, 2019

This week I talk about the Windows Background Activity Monitor, an artifact that may be used to find evidence of execution.

DFSP # 194 - Powershell Collection Tools Nov 05, 2019

This week I talk about some issues surrounding powershell when used as a digital forensic collection tool.

DFSP # 193 - LOKI Oct 29, 2019

This week I talk about LOKI, a tool designed to help analyst scan for APT IOCs.

DFSP # 192 - KAPE Oct 22, 2019

This week I talk about KAPE, a freely available forensic evidence collection and triage tool.

DFSP # 191 - Linux File Systems Oct 15, 2019

This week I talk about the common Linux file systems and what to expect when dealing with different hosts.

DFSP # 190 - Dead Simple Boot Disks Oct 09, 2019

This week I go over how to create a boot disk using the native capability of Ubuntu. You'll never have to rely on third-party tools again!

DFSP # 188 - Container Attack Vectors Oct 01, 2019

This week I breakdown container attack vectors for Cloud Incident Response.

DFSP # 187 - SUDOERS File and Forensics Oct 01, 2019

This week I breakdown the SUDOERS file for forensic triage.

DFSP # 186 - Powershell Forensics Oct 01, 2019

This week I talk about Powershell through the lens of the Service Control Manager.

DFSP # 189 - NVMe Oct 01, 2019

This week I talk about NVMe, a data storage technology, from a forensic point of view.

DFSP # 185 - Understanding Linux Executables Sep 30, 2019

This week I cover how to approach Linux binaries during investigations.

DFSP # 184 - Cloud Incident Response Aug 27, 2019

This week I continue the series about the DFIR changes on the horizon with cloud technology and focus on AWS EC2 forensics.

DFSP # 183 - WMI Forensics Aug 20, 2019

This week I talk about using WMI to create processes remotely.

DFSP # 182 - Density Scout Aug 13, 2019

This week I talk about Density Scout, an open source tool for malware triage.

DFSP # 181 - Remote Execution One-Liners Aug 06, 2019

This week I cover a resource you can use to develop windows remote execution triage methodology and threat hunting.

DFSP # 180 - Credential Guard Jul 30, 2019

This week I talk about the Windows credential guard process.

DFSP # 179 - OWASP: Insufficient logging and monitoring Jul 23, 2019

This week I talk about OWASP's Number 10 vulnerability category from their top 10 list, insufficient logging and monitoring.

DFSP # 178 - Attacker Recon Commands Jul 16, 2019

This week I talk about the most frequently seen attacker recon commands.

DFSP # 177 - PSEXEC Forensics Jul 09, 2019

This week I talk about a popular Windows utility attackers often exploit.

DFSP # 176 - Cloud Incident Response Jul 02, 2019

This week I talk about incident response in container deployments.

DFSP # 175 - OWASP: Components with Known Vulnerabilities Jun 25, 2019

This week I talk about OWASP's Number 9 vulnerability category from their top 10 list, components with known vulnerabilities.

DFSP # 174 - The VMEM Experience Jun 18, 2019

This week I talk about the challenges of working with VMEM files for memory forensics.

DFSP # 173 - Cloud Incident Response Jun 11, 2019

This week I talk about the DFIR changes on the horizon with cloud technology.

DFSP # 172 - High Optane Jun 04, 2019

This week I talk about Intel's emerging technology called Optane end it anticipated affects on DFIR investigations.

DFSP # 171 - OWASP: Breakfast Cereal May 28, 2019

This week I talk about OWASP's Number 8 vulnerability category from their top 10 list, insecure deserialization.

DFSP # 170 - The Crypto-Landscape May 21, 2019

This week I talk about the crypto attack landscape.

DFSP # 169 - Will The Future Kill DFIR? May 14, 2019

DFIR are professionals often worry if advances in artificial intelligence and automation are going to put them out of work. This week I address the issue and give my projection, based on expert sources, of what the future of forensics will look like.

DFSP # 168 - Is CEH Still Relevant? May 07, 2019

I recently passed my certified ethical hacker certification test. This week I thought I would talk about why I chose the certification.

DFSP # 167 - OWASP: XSS Apr 30, 2019

This week I talk about OWASP's Number 7 vulnerability category from their top 10 list, cross site scripting.

DFSP # 166 - SVCHOST Abuse Apr 23, 2019

This week I talk about SVCHOST. This Windows core process is one of the most targeted artifacts that comes up again and again during investigations.

DFSP # 165 - Windows Core Processes Apr 16, 2019

This week I go over how to approach windows core processes from the standpoint of fast triage methodology. Since these processes are found on all window systems it makes sense to develop and investigative approach that focuses on quickly reviewing each process for anomalies.

DFSP # 164 - Mobile Device Compromise Assessment Apr 09, 2019

This week I talk about the investigative value of creating a mobile compromise assessment strategy.

DFSP # 163 - DFIR Job Interviews Apr 02, 2019

This week I share my thoughts on DFIR job interviews. How to prepare. Things to consider. Pitfalls to avoid.

DFSP # 162 - OWASP: Security Misconfigurations Mar 26, 2019

This week I talk about OWASP's Number 6 vulnerability category from their top 10 list, Security Misconfiguration. I explore the issue from a DFIR point of view.

DFSP # 161 - Social Engineering Toolkit Mar 19, 2019

This week I talk about all the fun you can have ethically hacking with SET

DFSP # 160 - Serpico Mar 12, 2019

Serpico makes report writing suck less! Check it out.

DFSP # 159 - Linux Triage Mar 05, 2019

This week I talk more about Linux triage methods.

DFSP # 158 - OWASP: Broken Access Control Feb 26, 2019

This week I talk about OWASP's Number 5 vulnerability category from their top 10 list, Broken Access Control. I explore the issue from a DFIR point of view.

DFSP # 157 - File Comparison Strategies Feb 19, 2019

This week I discuss some techniques for comparing files and folders for DFIR investigations.

DFSP # 156 - B2B: Career Maintenance Feb 12, 2019

This week I share my thoughts on assessing DFIR career path progression.

DFSP # 155 - YARA Almighty Feb 05, 2019

This week I talk about the forensic value of YARA.

DFSP # 154 - OWASP: XXE Jan 29, 2019

This week I talk about OWASP's Number 4 vulnerability category from their top 10 list, XXE attacks. I explore the issue from a DFIR point of view.

DFSP # 153 - Google Dorks Jan 22, 2019

This week I talk about the Google Hacking Database.

DFSP # 152 - CEWL Jan 15, 2019

This week I talk about CEWL, a freely available tool for crawling websites to produce unique wordlists (think password attacks!)

DFSP # 151 - Autoweb Project Jan 08, 2019

This week I talk about my new Github page and the autoweb script.

DFSP # 150 - AppLocker Bypass Jan 03, 2019

This week I talk about Applocker Bypass from a DFIR point of view.

DFSP # 149 - OWASP: Sensitive Data Exposure Dec 27, 2018

This week I talk about OWASP's Number 3 vulnerability category from their top 10 list, sensitive data exposure. I explore the issue from a DFIR point of view.

DFSP # 148 - Threat Hunting Tips Dec 18, 2018

This week I talk about tips for building a threat hunting program.

DFSP # 147 - Webshell Breakdown Dec 11, 2018

This week I break down webshells for threat hunting and incident response triage.

DFSP # 146 - Mimikatz Detection Dec 04, 2018

This week I talk about contacting Mimikatz through windows event log.

DFSP # 145 - PDF Forensics Nov 27, 2018

This week I talk about PDF analysis tools to check for malicious indictors in PDFs.

DFSP # 144 - OWASP: Broken Authentication Nov 20, 2018

This week I talk about OWASP and why you should be paying attention.

DFSP # 143 - Tips from the Trenches Nov 13, 2018

Tips from the DFIR Trenches

DFSP # 142 - CRON 101 Nov 06, 2018

This week I breakdown CRON for the uninitiated.

DFSP # 141 - Logon Triage Oct 30, 2018

This week I talk about investigation strategies for logon events.

DFSP # 140 - PCAP Hunting Oct 23, 2018

This week I talk about PCAP hunting strategies.

DFSP # 139 - Linux Crypto-Mining Malware Tactics Oct 16, 2018

This week I interview Craig Rowland of Sandfly Security about crypto-mining attacks on Linux systems. Learn more about Sandfly at https://www.sandflysecurity.com

DFSP # 138 - OWASP Top 10 Oct 09, 2018

This week I talk about OWASP and why you should be paying attention.

DFSP # 137 - Fast Flux Oct 02, 2018

This week I talk about the attack methodology known as Fast Flux.

DFSP # 136 - Scheduled Task Triage Part 2 Sep 25, 2018

This week I talk about details about what to look at in Scheduled Task records for forensic triage.

DFSP # 135 - Scheduled Task Triage Part 1 Sep 18, 2018

This week I talk about details about what to look at in Scheduled Task records for forensic triage.

DFSP # 134 -OfficeMalScanner Sep 11, 2018

This week I talk OfficeMalScanner, a malware scanner for Microsoft document

DFSP # 133 - Know Thy Logs Sep 04, 2018

This week I talk Ultimate windows security

DFSP # 132 - Root Cause Aug 28, 2018

This week I talk about methodologies to investigate root cause during incident response investigations.

DFSP # 131 - PIDS Aug 21, 2018

This week I talk about PIDS in their uses and computer forensic investigations.

DFSP # 130 - Network Scoping Aug 14, 2018

This week I talk about scoping network connections as part of incident response triage

DFSP # 129 - Excel Fu for Frequency Analysis Aug 07, 2018

This week I talk more excel fu tips

DFSP # 128 - GREP vs SED vs AWK Jul 31, 2018

This week I talk the difference between common text processing utilities used in forensic analysis

DFSP # 127 - DNS & Forensics Jul 24, 2018

This week I talk about DNS and forensics

DFSP # 126 - Star Grepping Jul 17, 2018

This week I talk about the value of Grep as a forensic skillset

DFSP # 125 - Distributed Hash Cracking Jul 10, 2018

This week I talk about distributed password cracking with Hashtopolis for Hashcat

DFSP # 124 - iOS USB Restricted Mode Jul 03, 2018

This week I talk about the security changes coming with iOS 11.4

DFSP # 123 - IP Triage Jun 26, 2018

This week I talk about IP address and domain triage for computer forensic investigations.

DFSP # 122 - ATT&CK Matrix Jun 19, 2018

This week I talk about ATT&CK for Enterprise

DFSP # 121 - Adventures in Scripting Jun 12, 2018

This week I talk about getting started in scripting

DFSP # 120 - Rita Jun 05, 2018

This week I talk about Rita, a free Threat Hunting Tool from Black Hills Information Security

DFSP # 119 - MFT2CSV May 29, 2018

This week I review mft2csv

DFSP # 118 - .bash_history forensics May 22, 2018

This week I talk about Linux triage using the /.bash_history artifact

DFSP # 117 - USNJRNL Tool Review May 15, 2018

This week I review two tools for extracting and parsing USNJRNL evidence.

DFSP # 116 - Automatic Detection of Malware from Memory Analysis May 08, 2018

This week I talk about a clever way to leverage Volatility to triage malware on a target system

DFSP # 115 - Prefetch Tools May 01, 2018

This week I talk about 6 different prefetch tools that are FREE!

DFSP # 114 - Go Norse! Apr 24, 2018

This week I talk about keeping up with attack intelligence.

DFSP # 113 - Dead Simple Timelines Apr 17, 2018

This week I do a tool review of CYLR and CDQR - perhaps the easiest way to build an awesome timeline

DFSP # 112 - Port Forensics? Apr 10, 2018

This week I talk how common ports plays into network forensics.

DFSP # 111 - Network Triage Apr 03, 2018

This week I go over some Network Forensic artifacts and what they offer to an investigation.

DFSP # 110 - Web Browser Forensics with Foxton Mar 27, 2018

This week I review two freely available forensic tools from Foxton Forensics

DFSP # 109 - OLEDump Mar 20, 2018

This week I talk about OLEDump, a malware analysis tool for investigating suspicious macros in MS Office documents

DFSP # 108 - Under the Radare Mar 13, 2018

This week I talk about Cutter, a static malware analysis tool by Radare

DFSP # 106 - Cryptocurrency 1-2-3 Feb 27, 2018

This week I go over an easy way to get set-up to start using crypto-currency to testing \ validation \ and self-training purposes

DFSP # 105 - from Zero to JTAG Feb 20, 2018

This week I interview an industry expert about mobile device JTAG and ISP forensics.

DFSP # 104 - UserAssist Forensics Feb 13, 2018

This week I talk about the userassist artifact for file use and knowledge investigations.

DFSP # 103 - B2B USB Forensics Feb 06, 2018

This week I talk about resolving USB usage back to specific systems and user accounts.

DFSP # 102 - B2B Windows Explorer Jan 30, 2018

This week I talk about Windows Explorer evidence.

DFSP # 101 - B2B Shellbags Jan 23, 2018

This week I talk about Windows Shellbags.

DFSP # 100 - B2B Shimcache Jan 16, 2018

This week I continue the back to basics series with talk on the Windows Shimcache.

DFSP # 099 - B2B with Prefetch Jan 09, 2018

This week it's a refresher on the Windows Prefetch, a core Microsoft artifact every examiner should know.

DFSP # 098 - Back to basics 2018 Jan 02, 2018

This week I kick off a revisit of the fundamentals helpful to all new examiners.

DFSP # 097 - The Main Event Dec 26, 2017

This week I go over some "go to" Windows Event Logs.

DFSP # 096 - OS X Unified Logging Dec 19, 2017

This week I talk about Mac Logs, namely the new Unified Logging in OS X and how this impacts forensic exams.

DFSP # 095 - freE-DISCOVERY? Dec 12, 2017

This week I talk about the "built-in" eDiscovery tools for Office 365

DFSP # 094 - 31 Flavors of Malware Analyst Dec 05, 2017

This week I break down the different variations of the "malware analyst." Do you qualify as one?

DFSP # 093 - Chocolate Peanut Butter Moment Nov 28, 2017

This week I talk about the volatility plug-ins for autopsy that allow you to do memory forensics in the autopsy forensic console.

DFSP # 092 - New Apple File System Nov 21, 2017

This week I talk about the new file system released by Apple, APFS, and what it means for forensic examiners.

DFSP # 091 - Red Team Field Manual Nov 14, 2017

This week I talk about RTFM, the companion to the blue team field manual that's filled with over 1000 commands for windows and Linux.

DFSP # 090 - Microsoft Evaluation Center Nov 07, 2017

This week talk about the Microsoft Evaluation Center, a resource Microsoft office to obtain evaluation versions of operating systems and products.

DFSP # 089 - So you want to DFIR? Oct 31, 2017

This week I interview a DFIR practitioner about some of the little known facts about a career in the industry.

DFSP # 088 - Perfect Execution Oct 24, 2017

This week I talk about the most popular artifacts to prove application execution

DFSP # 087 - DFIR Degrees Oct 17, 2017

This week I interview a DFIR professional about his decision to get a Masters Degree in cyber security.

DFSP # 086 - BambiRaptor Oct 10, 2017

This week I review a freely available Windows Live Response collection tool available from BriMor Labs.

DFSP # 085 - Leggo my Stego Oct 03, 2017

This week I talk Stego; what it is and what challenges is presents to DFIR professionals.

DFSP # 084 - Blue Team Field Manual Sep 26, 2017

This week I review Blue Team Field Manual, a reference guide for DFIR practitioners.

DFSP # 083 - cree.py Sep 19, 2017

This week I talk about cree.py, an OSINT tool to profile social media accounts by geolocation.

DFSP # 082 - iPhone Forensics on the Cheap Sep 12, 2017

This week I talk how to make a forensic iPhone backup using iTunes and triage of iPhone backup files using free forensic tools.

DFSP # 081 - OS X Collector Sep 05, 2017

This week I go over OSX Collector, a freely available tool to collect and preprocess Mac artifacts for DFIR investigations.

DFSP # 080 - DFIR Operational Assessment Aug 29, 2017

This week I talk about 4 questions about your DFIR unit from an operations standpoint to identify holes and get a better sense of your investigative capabilities.

DFSP # 079 - Thoughts on DASH Forensics Aug 22, 2017

This week I talk about crypto currency 2.0 and feature DASH as the example.

DFSP # 078 - Bitcoin Forensics Aug 15, 2017

This week I provide an overview of Bitcoin forensics for examiners new to these investigations.

DFSP # 077 - Crypto Currency 101 Aug 08, 2017

This week I break down crypto currency concepts for new computer forensic examiners.

DFSP # 076 - Strings! Aug 01, 2017

This week I look talk about one of the most versatile tools for forensic triage and analysis - Strings!

DFSP # 075 - Capturing Websites as Evidence Jul 25, 2017

This week I look at a methodology of capturing websites as evidence using HTTrack

DFSP # 074 - Detecting Lateral Movement Jul 18, 2017

This week I review a document put out by the Japan Computer Emergency Response Team Coordination Center on "Detecting Lateral Movement through Tracking Event Logs."

DFSP # 073 - Jump Lists Jul 11, 2017

This week I break down the forensic value of Windows Jump lists.

DFSP # 072 - Free Training & Free Beer Jul 04, 2017

This week I talk about how to design your own training programs using low cost\ no cost options.

DFSP # 071 - Automated Malware Triage Jun 27, 2017

This week I take a look at online sandboxes for malware analysis.

DFSP # 070 - Notepad++ Jun 20, 2017

This week I talk a Notepad++, a freely available code editing tool with some great options built in that are useful for inspecting forensic artifacts.

DFSP # 069 - Automated Memory Triage Jun 13, 2017

This week I take a look at Redline by Mandiant, a tool that offers automated memory triage and much more.

DFSP # 068 - Is Scanning On-Scene Legit? Jun 06, 2017

This week I explore the idea of using scanning tools as part of an on scene triage process in order to find hidden devices and\or to document the systems of the local network.

DFSP # 067 - IR A-Z May 30, 2017

Looking for the ultimate DFIR checklist? This week I check out a freely available guidebook that, as the name implies, is aimed at addressing all things DFIR related A-Z.

DFSP # 066 - Skype Forensics May 23, 2017

This week I talk about the Skype artifacts forensic examiners need to be aware of.

DFSP # 065 - Is CSA+ Certification right for you? May 16, 2017

This week I take a look at CompTia's CSA+ certification and how it fits into a DFIR career.

DFSP # 064 - Chrome Forensics May 09, 2017

This week it's back to browsers with Chrome Forensics.

DFSP # 063 - Bulk Extractor May 02, 2017

This week is tool review week featuring Bulk Extractor. This is a great triage tool, lab tool and all around tool to help generate leads for your case.

DFSP # 062 - Building a Forensic VM with VirtualBox Apr 25, 2017

This week I take you through some of the "pain points" of using VirtualBox as a forensic machine virtualization platform. VirtualBox is freely available and is a great tool to scale your lab and field systems at a low cost. VirtualBox does not have the "easy" buttons the pay tools have but do not let that stop you. In this episode I talk about the solutions that will have you up and running.

DFSP # 061 - Firefox Forensics Apr 18, 2017

This week I talk Firefox forensics and identify the artifacts examiners need to know about.

DFSP # 060 - Browsing on the Edge Apr 11, 2017

This week I’m talking about the Windows browser some are still surprised to learn about, MS Edge. Windows 10 comes with two browsers and in this week’s podcast I’m going to go over one of them, MS Edge, and what computer forensic examiners need to know about it.

DFSP # 059 - Thumbcache Forensics Apr 04, 2017

This week I talk about surviving Windows Thumbcache forensics. A great source of evidence for File Use & Knowledge investigations.

DFSP # 058 - Linux FU&K Artifacts Mar 28, 2017

This week I talk Linux forensics and breakdown some useful artifacts that may generate leads for investigations.

DFSP # 057 - Webmail Collections Mar 21, 2017

This week I talk about a methodology to collect webmail using freely available tools as well as the things you must consider before you do so.

DFSP # 056 - Surviving Solid State Drives Mar 14, 2017

This week I go over my survival tips for imaging solid state drives (SSDs).

DFSP # 055 - Automated Host Intelligence Mar 07, 2017

This week I talk about threat intelligence tool Hostintel by Keith Jones.

DFSP # 054 - Surviving the Conference Season Feb 28, 2017

This week I share some thoughts on how to approach DFIR conferences to maximize the experience. There are many to choose from and having an analytical approach may get you exactly what you want for your time and money.

DFSP # 053 - Top FU&K Plugins Feb 21, 2017

This week I talk about my favorite Volatility plugins for File Use & Knowledge investigations to get at the volatile evidence most often targeted during a dead box exam.

DFSP # 052 - Free Your Mind Feb 14, 2017

This week I talk about FreeMind, a freely available visualization tool that can be used to enhance the computer forensic investigation process.

DFSP # 051 - Analyzing PE Signatures Feb 07, 2017

This week I talk about an openly available library and tool repository all examiners should be aware of as well as a tool by Didier Stevens called "AnalyzePESig" which is perfect for bulk analysis of executables on Windows systems.

DFSP # 050 - Virtual Machine Forensics Jan 31, 2017

This week I talk File Use & Knowledge investigations involving virtual machines. This is mainly from a dead-box exam point-of-view.

DFSP # 049 - Get your SRUM on! Jan 24, 2017

This week I talk about SRUM, a windows artifact with some significant forensic value for both File Use & Knowledge investigations as well as Incident Response.

DFSP # 048 - Evidence Integrity On-Scene Jan 17, 2017

This week I talk about considerations for digital evidence integrity when collection evidence on-scene from a live system.

DFSP # 047 - Epoch Time Survival Jan 10, 2017

This week I talk about surviving mobile App timestamps.

DFSP # 046 - DFIR New Year Jan 03, 2017

This week I share my thoughts on setting DFIR goals for the coming year. I go over seven points worth focusing on for professional development.

DFSP # 045 - RUN DMA Dec 27, 2016

This week I talk DMA (direct memory access) exploits as a technique to bypass passwords of a live system to conduct imaging - with legal authority of course.

DFSP # 044 - Automated File Intelligence Dec 20, 2016

This week I talk about a useful automated file intelligence resource for dead box exam as well as IR investigations.

DFSP # 043 - Imaging a Mac: Survival Tips Dec 13, 2016

This week I go over survival tips for imaging a Mac.

DFSP # 042 - Windows 10 Prefetch Dec 06, 2016

This week I about the format change for Windows 10 Prefetch files as well as a freely available tool to decompress and present .pf file data.

DFSP # 041 - Trash Talkin' Nov 29, 2016

This week I'm talking .Trash. I cover the forensic basics of this Mac artifact that examiners need to know.

DFSP # 040 - Mac Log Files Nov 22, 2016

This week I talk about Mac Log files that are useful for File Use & Knowledge investigations as well as Incident Response.

DFSP # 039 - Apache Weblogs & SDF Announcement Nov 15, 2016

This week I talk about Apache weblogs and a great resource for foundational knowledge at aid newer examiners with forensic analysis. In addition, big news for the SDF series!

DFSP # 038 - Finder Sidebar Forensics Nov 08, 2016

This week it's back to Mac forensics with a look at the the Finder Sidebar and it's value for File Use & Knowledge investigations.

DFSP # 037 - The DFIRONOMICON Nov 01, 2016

This week I pull back the focus for newer examiners and share some thoughts on creating a system that works for you to organize, and keep readily accessible, all the knowledge you accumulate..... and a few words about Shimcache on Windows 10.

DFSP # 036 - iCloud Forensic Evidence Oct 25, 2016

This week I breakdown iCloud forensic artifacts.

DFSP # 035 - "Recent" File Listings on a Mac Oct 18, 2016

This week I talk about where to find different listing of different recently accessed files on a Mac as well as how to break out the data for interpretation.

DFSP # 034 - Forensic tools for your Mac Oct 11, 2016

This week I go over some of my favorite Mac tools.

DFSP # 033 - PLISTS for Mac Triage Oct 04, 2016

This week I talk about some common PLISTS to check as part of an initial system triage.

DFSP # 032 - Mac Formats, Libraries & Keychains Sep 27, 2016

This week I talk about common Mac file formats, Libraries and Keychains.

DFSP # 031 - Mac User Home Folder Sep 20, 2016

This week I talk about Mac Home Folders to give Mac Examiners an idea of how it is structured and where to look for certain artifacts.

DFSP # 030 - OS X Spotlight Sep 13, 2016

This week I talk about OS X's Spotlight feature, a powerful indexing and search engine built into your Mac that may be harnessed for computer forensic purposes.

DFSP # 029 - Mac Cooties?! Sep 06, 2016

This week I talk Apple double files and what to make of them during a forensic exam.

DFSP # 028 - Microcast Aug 30, 2016

This week I am taking a breather and doing some planning for future topics. If you have a topic you would like to see covered mention it in the show notes. Full episodes will return the first week of September.

DFSP # 027 – Mac as a forensic platform Aug 23, 2016

This week I go over some of my top reasons why Macs should be considered as a computer forensic platform.

DFSP # 026 - File Juicer Aug 16, 2016

File Juicer is an easy to use data carving tool that runs on OS X. Take most any file, drop it on File Juicer, and watch it spin out embedded image, movie, document files and text. Perfect for on-scene triage, lab work and exploring new file types.

DFSP # 025 - RAM Extraction Tools - Part 2 Aug 09, 2016

This is part two of RAM extraction tools. Part 1 looked at why RAM extraction is an important part of forensic analysis. In Part 2 the results of a benchmark experiment with four different RAM Extraction tools is discussed: DumpIt, Belkasoft's RAM Capturer, Magnet RAM Capture and the RAM extraction feature in FTK Imager.

DFSP # 024 - RAM Extraction Tools - Part 1 Aug 02, 2016

This episode is a two-parter looking at RAM extraction tools. Part 1 will take a look at why RAM extraction is an important part of forensic analysis. Part 2 will go over an experiment I did with four different tools: DumpIt, Belkasoft's RAM Capturer, Magnet RAM Capture and the RAM extraction feature in FTK Imager.

DFSP # 023 - Battle Royale: FTK vs EnCase vs WinHEX Jul 25, 2016

This week I take a look at three popular computer forensic suites: FTK, Encase and WinHex. I offer my opinion as to the strengths and weaknesses of each.

DFSP # 022 - DFIR Certification Planning & Considerations Jul 19, 2016

If you take a look at all the different DFIR certifications that exist today you can easily get overwhelmed. There are so many to choose from it puts meaning to the saying that too many choices is no choice at all. In this episode I take a look at digital forensic certifications from two different vantage points to provide a little guidance to those that may be trying to advance themselves through a certification or two.

DFSP # 021 - The Honeynet Project Jul 12, 2016

For those looking to get some real world hands-on experience in DFIR to build up or expand your skill set, check out honeynet.org. The non-profit offers information and challenges to help sharpen your skills.

DFSP # 020 - Amcache Forensics - Find Evidence of App Execution Jul 05, 2016

This week I talk about Amcache Forensics, a Windows artifact that collects details about programs that have been run on a given system. This evidence can support malware/ intrusion investigations, file use and knowledge exams and data spoliations inquiries.

DFSP # 019 - Password Cracking with Hashcat Jun 28, 2016

The last talk in the Open-Source password cracking series focuses on a tool that rivals the pay tools in function and capability - Hashcat.

DFSP # 018 - John the Ripper Jun 20, 2016

Last episode I talked about using Cain to attack Windows LANMAN and NTLM hashes. Next we will discuss John the Ripper, Linux password files and rainbow tables.

DFSP # 017 - Cracking Passwords with Cain Jun 13, 2016

In the last episode I talked about PW psychology, an important part of operationalizing any PW cracking tool effectively. Face it, the math is against you so understanding a person’s probable PW patterns is important. In this episode we will talk about our first tool that can be used against a PW file. First let’s go over some general features you will likely find in a PW cracking tool.

DFSP # 0016 - Password Psychology Jun 06, 2016

The next mini series will focus on open source password attack tools. There are some pay options out there, however, most IR teams do not have a need for it and disk forensic teams use if infrequently. Despite this many labs want the capability so it makes sense to explore the open source options first before spending the money. My goal here is talk about these options to provide some insight and to open the series I thought I's talk about password psychology since the weakness link in any password algorithm is usually the person using it.

DFSP # 015 - $UsnJrnl File May 31, 2016

The $UsnJrnl is an artifact that logs certain changes to files in NTFS volumes. It is a great source of timeline information for malware\ IR investigations, time stomping concerns and anti-forensics activities (i.e. wiping) as well as an additional source of file use and knowledge evidence for disk forensics.

DFSP # 014 - Shimcache May 23, 2016

In this episode I talk Shimcache, otherwise known as the Application Compatibility Cache. This registry key has existed since Windows XP and tracks executable on a system, making it a great source of digital evidence for both disk forensics and incident response cases. In addition, there are freely available tools that will parse the data. It is not a difficult artifact to understand. Once an analyst spends the time learning how to pull, parse and interpret the data it is easily incorporated into an investigation and aligns well with other Windows artifacts.

DFSP # 013 - Windows 10 Artifacts May 16, 2016

In this episode I cover something I have been intending to do for some time: a Windows 10 artifacts overview. Here, I explore some key artifacts changes and what has stayed the same. Once I got into it I found there was a lot to talk about so, to start, I will discuss the topics from a high level. In future episodes I will dig in deeper to each artifact.

DFSP # 012 - Just-Metadata May 09, 2016

This episode I talk Just-Metadata, a freely available tool that gathers data about IP addresses from publicly available resources. Check out Truncer's website to learn more. I put together my quick start notes (below) for anyone interested in getting set up. This tool is very powerful and useful for Incident Response investigations, especially since you can batch upload IP addresses and quickly get useful details.

DFSP # 011 - PALADIN May 02, 2016

This episode I talk about PALADIN from SUMURI. PALADIN is a modified “live” Linux distribution based on Ubuntu that simplifies various forensics tasks in a forensically sound manner via the PALADIN Toolbox and used by thousands of digital forensic examiners from Law Enforcement, Military, Federal, State and Corporate agencies.

DFSP # 010 - Investigation Survival Tips Apr 25, 2016

This episode covers Investigation Survival Tips.... for the new guy. Newer examiners are often thrown into a world where it is there mission to find "everything." Not on that, they are usually given inadequate investigative support to accomplish their assigned goals. I have seen this happen often so I thought I would spend an episode giving some advice on how to steer the conversation to keep expectation realistic and in-check.

DFSP #009 - Linux for Computer Forensics Apr 18, 2016

In this episode I cover using Linux as a forensic platform... for the new guy. I find many examiners are very Windows-centric. There is nothing wrong with that as most tools and evidence is Windows based. However, Linux comes in handy from time to time and knowing some basic commands is always helpful.

DFSP # 008 - Virtual Machines & Computer Forensics Apr 11, 2016

In this episode I talk all about virtual machines; the reasons you should be using them (more), prebuilt ones that are freely available and loaded with digital forensic tools and a free virtual machine application that has the same functionality you need as the pay tools.

DFSP #007 - File Use & Knowledge Wrap Up Apr 04, 2016

In this episode we wrap up the File Use & Knowledge artifacts discussed previously and talk about how they connect to help strengthen a case.

DFSP #006 - Resolving Attached USBs Mar 28, 2016

Have you ever been asked to find out what the "F" drive is? Have you ever needed to prove a USB drive was attached to a target system? Collecting and presenting this information is a core skill all computer forensic analysts need know. This episode breaks down the process of collecting and interpreting the data necessary to make the connection between USB device and Windows systems.

DFSP #003 - What the Shellbag! Mar 21, 2016

In this episode we examine how to use Windows Shellbag records to help prove file use and knowledge. Shellbag records are created by certain user activity and can be used to show where a user has navigated to on a computer system and when they did so. Very powerful evidence!

DFSP #004 - Windows Prefetch Mar 14, 2016

Windows Prefetch data is a great source of evidence to help determine file use and knowledge of applications running on the system.

DFSP #003 - Windows Explorer Evidence Feb 17, 2016

Oftentimes you will be asked to find information on a target system that shows if a user accessed certain files, the last time they did and/ or how often they did. Being able to put a picture together that answers these questions can be critical and make or break the case.

DFSP #002 - Windows Link Files Feb 15, 2016

Windows LINK files are a great source of information when your aim is proving file use and knowledge during a computer forensic investigation. Knowing how to interpret these files will break reliance on automated tools and give you the versatility to quickly examine - interpret - and gain investigative insight.

DFSP #001: Premiere Episode Feb 14, 2016

Listen to talk about computer forensic analysis, techniques, methodology, tool reviews and more.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Digital Forensic Survival Podcast

Related Podcasts

Links

Stay Connected