DFSP # 395 - Lateral Movement and Admin Logons
This week is on lateral movement detection techniques. Inspecting Domain Admin account logons is a key component to lateral movement triage. Admin accounts are sought after by attackers for their elev...
12 Syys 202318min
DFSP # 394 - Functional Documentation
This week I want to talk about the value of having functional documentation for your organization, or, at least for your team. Functional documentation means you have thoughtful and up-to-date inciden...
5 Syys 202315min
DFSP # 393 - Linux Subsystems for Windows
The linux subsystem for windows, create both opportunity and challenges for forensic analysts. It makes Windows an excellent platform for multi platform forensic analysis tasks, allowing it to take it...
29 Elo 202324min
DFSP # 392 - Simulation Training
This week I'm going to talk about tabletop exercises as part of a security training program. I feel that there is too much focus on technical skill training and not enough focus on actual incident man...
22 Elo 202320min
DFSP # 391 - Investigation Lifecycle
This week I'm talking about The NIST (National Institute of Standards and Technology) investigation lifecycle. The NIST investigation lifecycle encompasses a series of well-defined steps, starting fro...
15 Elo 202326min
DFSP # 390 - SSH Triage
This week I'm talking about linux forensic triage strategy. In particular, I'm covering SSH. SSH traffic comes up in many different types of investigations. For that reason, it is a common and standar...
8 Elo 202317min
DFSP # 389 - $Usnrl
The USN Journal, also known as the Update Sequence Number Journal, is a feature of the Windows operating system that serves as a record of changes made to files and directories on a disk volume. It pr...
1 Elo 202315min
DFSP # 388 - Web 3.0 Talk with SUMURI
This week Jason Roslewicz from SUMURI returns for some web 3.0 and virtual reality talk.
25 Heinä 202338min
