mikeber.blogg.se - Prodiscover basic report compared to ftk demo report

#PRODISCOVER BASIC REPORT COMPARED TO FTK DEMO REPORT HOW TO#
#PRODISCOVER BASIC REPORT COMPARED TO FTK DEMO REPORT CODE#
#PRODISCOVER BASIC REPORT COMPARED TO FTK DEMO REPORT SERIES#
#PRODISCOVER BASIC REPORT COMPARED TO FTK DEMO REPORT WINDOWS#

William Tsing at Malwarebytes Labs recaps the Lazarus group, a/k/a Hidden Cobra a/k/a Guardians of Peace whose best known attack may be the one on Sony Pictures in 2014.

SQL Injection – Understand Double Query Injection in depth | Lucideus

#PRODISCOVER BASIC REPORT COMPARED TO FTK DEMO REPORT HOW TO#

Sudharshan Kumar at Lucideus gives an example of SQL Injection using Double Queries including how to pull a database name and showing what happens when count() and Group by are used together.

Snort Basics for Hackers, Part 5: Testing your Snort IDS Against Known Exploits

#PRODISCOVER BASIC REPORT COMPARED TO FTK DEMO REPORT SERIES#

Hackers-arise continues a series about how to run Snort, here by using Kali and testing Snort on known intrusion files and generating alerts.Grapl – A Graph Platform For Detection and Response Colin at Insanitybit demonstrates how Grapl, “an open source platform for Detection and Response”, can be used in an incident.Going ATOMIC: Clustering and Associating Attacker Activity at Scale Matt Berninger at FireEye looks at how to cluster attacks using scoring and then building a data set to draw conclusions from.Dani Wood at Cybereason released a white paper on how to combine “TTPs with adversary emulation plans the background to building threat hunting and red teaming programs based on the MITRE ATT&CK framework.”ĭefensive Gap Assessment with MITRE ATT&CK.Richard Bejtlich at Corelight discusses how NSM professionals should consider the “first, do no harm” credo when recommending security monitoring solutions unlike examples Bejtlich cites in the article, NSM should be passive and set up to not be a single failure point.Check Point Research have a post about developing Cuckoo extensions to manage AWS instances and more, allowing for parallel task performance without wasting resources.

#PRODISCOVER BASIC REPORT COMPARED TO FTK DEMO REPORT CODE#

CERT Polska previews their incident 2018 report with categories like fraud (includes phishing and copyright issues) making up 50% of reported incidents, followed by malicious code at 23%, then abusive content (from harmful speech to spam) around 11%.Hexa at Brokesec looks at honeypot techniques to get new malware samples and what different honeypots exist including low vs medium interaction honeypots.A Demoscene PE file is shown as an example that has no apparent DOS Stub and fails to load in various PE test beds.The PE Compilation timestamp is Unix epoch time, but what timezone is it in? A simple test shows local time (Die, IDA, Efd, PE Studio) vs UTC time (Die, IDA, Efd, PE Studio) tools.Thinking back on the Ghidra release, Adam speculates on motivation behind NSA releasing Ghidra and GCHQ releasing CyberChef.The story of an underTAG that tried to wear a mitre… A discussion of tagging data with Mitre tags, tagging activity with your own classifications, and the need for context instead of simply tagging for identification.Adam at Hexacorn posted a few times this week.

#PRODISCOVER BASIC REPORT COMPARED TO FTK DEMO REPORT WINDOWS#

Windows ID 4648 “A logon was attempted using explicit credentials”

Hideaki also looks at event log ID 4648.

He continues looking into ADTimeline, checking the effects of ACL changes.

Hideaki Ihara at port139 posted a couple of times this week.

Neal Krawetz at ‘The Hacker Factor Blog’ describes the process of texting pictures and its effects on the files content and metadata.

This week’s Sunday Funday relates to gathering the “available forensic data sources provided by Amazon AWS for EC2”.

The winner of last week’s Sunday Funday was Tun Naung, who with a little convincing has started a blog where he posted his answer,ĭaily Blog #642: Solution Saturday 3/9/19.

Dave Cowen at the ‘Hacking Exposed Computer Forensics Blog’ wrote a couple of posts this week.

As always, Thanks to those who give a little back for their support ! FORENSIC ANALYSIS