DFSP # 395 - Lateral Movement and Admin Logons
This week is on lateral movement detection techniques. Inspecting Domain Admin account logons is a key component to lateral movement triage. Admin accounts are sought after by attackers for their elev...
12 Sep 202318min
DFSP # 394 - Functional Documentation
This week I want to talk about the value of having functional documentation for your organization, or, at least for your team. Functional documentation means you have thoughtful and up-to-date inciden...
5 Sep 202315min
DFSP # 393 - Linux Subsystems for Windows
The linux subsystem for windows, create both opportunity and challenges for forensic analysts. It makes Windows an excellent platform for multi platform forensic analysis tasks, allowing it to take it...
29 Aug 202324min
DFSP # 392 - Simulation Training
This week I'm going to talk about tabletop exercises as part of a security training program. I feel that there is too much focus on technical skill training and not enough focus on actual incident man...
22 Aug 202320min
DFSP # 391 - Investigation Lifecycle
This week I'm talking about The NIST (National Institute of Standards and Technology) investigation lifecycle. The NIST investigation lifecycle encompasses a series of well-defined steps, starting fro...
15 Aug 202326min
DFSP # 390 - SSH Triage
This week I'm talking about linux forensic triage strategy. In particular, I'm covering SSH. SSH traffic comes up in many different types of investigations. For that reason, it is a common and standar...
8 Aug 202317min
DFSP # 389 - $Usnrl
The USN Journal, also known as the Update Sequence Number Journal, is a feature of the Windows operating system that serves as a record of changes made to files and directories on a disk volume. It pr...
1 Aug 202315min
DFSP # 388 - Web 3.0 Talk with SUMURI
This week Jason Roslewicz from SUMURI returns for some web 3.0 and virtual reality talk.
25 Jul 202338min
