Digital Forensic Survival Podcast

This week I'm talking about detecting evidence of lateral movement on Window systems using NTLM credential validation events. Much like the episode I did on Kerberos, NTLM events offer the same advant...

2 Tammi 202418min

Temporary directories play a significant role in computer forensic investigations as they can potentially contain valuable digital evidence. When conducting a computer forensic investigation, these te...

26 Joulu 202315min

This week I'm talking about Regsvcs /Regasm exploitation, which is a Windows tactic attackers use to evade defense mechanisms and execute code. Specifically, this technique can be used to bypass proce...

19 Joulu 202311min

This week I'm talking about Nested Groups and the risk they pose for security. Built-in to the functionality of Active Directory is the ability to attach a group to another group. While this has advan...

12 Joulu 202313min

This week it's more about lateral movement and kerberos events.

5 Joulu 202319min

In a typical Linux "bin" directory, you can find various types of executable files and scripts that are used to perform different tasks. The confusing part is that there are a number of different BIN ...

28 Marras 202314min

Werfault is in interesting artifact in that there is not a lot of documentation on it but yet it may affect an investigation in different ways.  Its appearance in logs sometimes adds a bit of confusio...

21 Marras 202314min

Certutil, a powerful command-line utility, possesses the potential for misuse by malicious actors to establish illicit network connections. Therefore, it is crucial to familiarize oneself with its leg...

14 Marras 202312min