Digital Forensic Survival Podcast
This week I'm discussing a fundamental aspect of cybersecurity: incident response preparation. Effective incident response is paramount, and preparation is the key to success. This preparation includes comprehensive documentation, training, having the right tools and resources in place, and developing incident response plans and playbooks. It also involves ensuring clear communication protocols and conducting regular training and testing. I'll explore preparation from the perspective of the investigation life cycle, where success is the reward for preparation. Join me as I uncover the...
info_outline DFSP # 422 - EVTX Express: Cracking into Windows Logs Like a ProDigital Forensic Survival Podcast
Today I'm talking Windows forensics, focusing on Windows event logs. These logs are very valuable for fast triage, often readily available in your organization's SIEM. But have you ever wondered about the processes enabling this quick access? Not only are the logs automatically collected and fed into the appliance, but they are also formatted and normalized for easy data searchability. This is crucial, as the logs are originally in a complex format challenging to natively interpret. Now, picture a scenario where event logs are inaccessible through a security appliance—enter this week's...
info_outline DFSP # 421 - Memory Lane: Fileless Linux Attacks UnraveledDigital Forensic Survival Podcast
In this podcast episode, we talk about Linux's `memfd` – a virtual file system allowing the creation of anonymous memory areas for shared memory or temporary data storage. Threat actors exploit `memfd` for fileless malware attacks, as its memory areas exist only in RAM, evading traditional file-based detection methods. Join me as I `memfd` as a forensic artifact, its implications in DFIR, and strategies for detecting its abuse.
info_outline DFSP # 420 - Failing, Stopping and CrashingDigital Forensic Survival Podcast
This week we explore into the world of Windows service event codes and their role in forensic investigations. Windows services are background processes crucial for system functionality, running independently of user interaction- making them ideal. Target were exploitation. Join me to explore the intricate details of Windows services and their significance in digital forensics.
info_outline DFSP # 419 - What the FluxDigital Forensic Survival Podcast
This week, we're delving into the realm of fast flux, a cunning technique employed by attackers to cloak their true, malicious domains. Its effectiveness is the reason behind its widespread use, making it crucial for analysts to grasp its nuances and avoid chasing elusive ghosts during investigations. Stay tuned as I unravel the intricacies of fast flux, providing insights into what it entails and offering valuable tips on how to effectively detect it. All this and more coming your way!
info_outline DFSP # 418 - Core Insights: Navigating MFT in ForensicsDigital Forensic Survival Podcast
In this week's exploration, I'm delving into the intricate realm of the Master File Table (MFT), a pivotal forensic artifact in Windows investigations. The MFT provides a valuable gateway to decode evidence across various scenarios. Join me in this episode as we unravel the forensic basics, explore diverse use cases, and discover a range of tools that empower you to unlock the full potential of this invaluable artifact.
info_outline DFSP # 417 - Unlocking Linux SecretsDigital Forensic Survival Podcast
This week I delve into the intriguing domain of Linux malware triage. The Linux platform presents forensic analysts with a unique opportunity to excel in performing malware triage effortlessly. The beauty of it lies in the fact that you don't require any specialized tools; all you need is a solid grasp of a few commands and the ability to decipher their output. With these skills in your arsenal, any analyst can swiftly and efficiently navigate through the process of malware triage. Stay tuned for more insights on this in the upcoming discussion!
info_outline DFSP # 416 - Persistence Mechanisms on WindowsDigital Forensic Survival Podcast
This week I’m going to talk about New Service Installation details recorded in Windows event logs. These have a number of advantages for your triage methodology and I will have all the details coming up.
info_outline DFSP # 415 - Dealing with Third-Party IncidentsDigital Forensic Survival Podcast
Organizations leverage third-party services more and more for business advantages. For the security professional, this means the organizational data you're charged with protecting is under the control of a third-party in some way shape or form. In this episode, I cover third-party risk landscape for security professionals with a special focus on identifying scope and responsibility.
info_outline DFSP # 414 - CRON ForensicsDigital Forensic Survival Podcast
Cron become important and Linux forensics when you’re talking about persistence. Think scheduled tasks if you want a Windows equivalent. The artifact is not that difficult to analyze once you understand the elements to focus on and it is typically readily available. It’s something that you can check out a live system, gather with a collection script, and more and more security appliances are designed to access the artifact as well. I’ll...
info_outline