Write-ups

Forensic artifacts, investigative methodologies, tools, and techniques.

All write-ups

Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Triage a Windows host with KAPECollect the key artifacts from a live Windows machine and parse them into CSV files you can read straight away. Tooling Triage a Windows host with KAPECollect the key artifacts from a live Windows machine and parse them into CSV files you can read straight away. Tooling Triage a Windows host with KAPECollect the key artifacts from a live Windows machine and parse them into CSV files you can read straight away. Tooling Triage a Windows host with KAPECollect the key artifacts from a live Windows machine and parse them into CSV files you can read straight away. Tooling Proving execution with Prefetch and AmcacheTwo artifacts that show a program ran on a machine, what each one tells you, and what each one does not. Windows forensics