DFIR
Endpoint and memory forensics notes.
-
PowerShell for Responders
A quick reference for reading an endpoint from a remote response shell: get the data, filter it down, and format it so nothing truncates, without writing anything to disk.
-
Browser History for Initial Access: Collecting and Querying Chromium History
When the EDR shows PowerShell or a suspicious download but not how the user got there, the browser's SQLite history usually does. Find the right profile, collect a copy, and query it in DB Browser for SQLite.
-
Volatility - Hunting in Memory Lab 2
Advanced Volatility lab focused on detecting Linux rootkits (Diamorphine and Reptile) using kernel module analysis, syscall table verification, and inline hook detection.
-
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response
Digital forensics and incident response lab investigating a REvil/Sodinokibi ransomware attack, covering initial access, privilege escalation, lateral movement, credential theft, and encryption using Splunk log analysis and malware analysis techniques.
-
Volatility Memory Analysis: Hunting .NET Malware
Memory forensics exercise using Volatility to hunt for .NET malware, hidden processes, injected code, suspicious drivers, and Meterpreter/Mimikatz/Emotet indicators in a Windows 10 memory dump.
No posts match.