Dfir

Summary: Can we just update the LOLBAS to log when they get executed instead of having to monitor every single process across the whole network? And preferably have them log their parsed parameters too. So I continue my journey down the rabbit hole of detection coverage. For this post, I…

Memory dump is a very useful volatile artefact that basically contains all important artifacts you could find during run time like processes and programs running on the system, network connections, evidence of malware intrusion, registry hives, usernames and passwords, decrypted files and keys, MFT and evidence of activity not typically…

Windows Prefetch Files Prefetch is a windows mechanism to speed up loading of executable by caching it in the memory before it is actually needed so in effect speeding up the next execution. This started on Windows Vista and utilized up to the recent Windows versions. This is enabled by default on workstation…

Hello again guys for this post I will help guide you solve this challenge from Splunk team hosted in Cyberdefenders.org named Boss of the SOC v1. CTF really is a nice way to sharpen your investigation or blue team skills because in the SOC it’s not everyday you get to…

Prefetch files are encrypted by default. In order to view its contents, one needs to utilize certain tools and that’s what I will share today. Prefetch Parsing Tool One of the best tools out there is the pecmd.exe because of its ease of setting up and ease of use. PECMD.exe — prefetch parser…

Introduction It’s inevitable during your career in Digital Forensics and Incident Response (DFIR) that you’ll run into some very memorable cases. Some may be memorable due to the complexity of the case, but some may stick in your mind simply because of how wacky they ended up being! This is one…

Introduction. Chainsaw is a Windows-based tool developed by F-Secure (WithSecure). The tool provides a powerful ‘first-response’ capability to identify threats within Windows event logs quickly. It offers a generic and fast method of searching through event logs for keywords and identifying threats using built-in detection logic and via support for Sigma detection…

In order to learn how to write a somewhat “proper notes”, I pushed myself to writing public blog which hopefully will be beneficial not only for me. ;) Today, we have on a list a bit old but interesting OtterCTF (to get .vmem file, registration is needed) After downloading OtterCTF.vmem…

If you are using Amazon Web Services (AWS), it is important to understand the concept of AWS Identity and Access Management (IAM). IAM is a powerful tool that allows you to control access to AWS resources. One of the most important aspects of IAM is the use of access keys…