Week 12 – 2018

If you like my work and would like to nominate me for a 4Cast Award for Blog of the year that would be greatly appreciated. Nominations close at the end of this month.


  • Hideaki Ihara at the Port 139 blog takes a look at the “the Shell item structure of the LNK file.”
    LNKとShell item
  • Maxim Suhanov has uploaded a “new registry sample & a write-up [on] how applying an active log entry from a transaction log file can bring the hive to the “previous state” [and] missing log entries”
    Check out @errno_fail’s Tweet


  • Daniel Bohannon highlights “a bug [he] found in Sysmon’s event logging that contaminates process command line argument logging and adversely affects at least two different tools used for viewing Windows event logs.”
    Test Your DFIR Tools: Sysmon Edition
  • The InThreat team at Sekoia have compiled their findings on the MuddyWater threat group.
    Falling on MuddyWater


  • Lisa Stewart and Harp Thukral at OpenText will be demonstrating “the new features of EnCase Forensic 8.06 and share tips & tricks for best practices along the way that can improve your case efficiency”. The webinar will take place on Wednesday, April 04, 2018 at 11:00 AM Pacific Daylight Time
    How to Conduct More Efficient Examinations with EnCase Forensic 8.06
  • OpenText released the program for Enfuse 2018. If you’re going there hit me up, I’ll be speaking about personal branding in DFIR on the Wednesday afternoon.
    Enfuse 2018 program is here
  • The Techno Security program has been released. I’ll be there too! (And not presenting so less stressed)
    2018 Conference Program


  • Hasherezade has uploaded a video showing how to unpack a ursnif sample
    Unpacking Ursnif
  • Martin Barrow at Magnet Forensics has uploaded a video showing how to use Axiom to load a custom image onto a Samsung device to extract data.
    AXIOM   Advanced Recovery Samsung
  • On this week’s Digital Forensics Survival Podcast Michael talked about Didier Stevens oledump tool.
    DFSP # 109 – OLEDump
  • Eric Zimmerman will be hosting a webinar on the latest updates to his registry parsing tools on Wednesday, March 28th, 2018 at 3:30 PM EST (19:30:00 UTC).
    Exploring Registry Explorer
  • Steve and Jason at Sumuri talk about how they are coping with the change in the availability of components for the Talino systems due to the current cryptocurrency miner craze.
    TALINO Talk ep13


  • Frédéric Vachon at WeLiveSecurity takes a look at “Glupteba, an open proxy previously distributed by exploit kits deployed as part of Operation Windigo”
    Glupteba is no longer part of Windigo


  • AccessData posted a brief interview with Tod Ewasko, their Director of Product Management, regarding incident response.
    Digital Forensics 101
  • Foreman Forensics added ‘account locking’, “where after a set number of incorrect passwords users cannot log into their accounts even when they have the correct password”.
    Account Locking
  • Griffeye shared their recent involvement in a project “run by The Department of Homeland Security’s Science and Technology Directorate in the USA, is called Child Exploitation Image Analytics (CHEXIA)”. The project seeks to use facial recognition algorithms on “datasets of seized images of child exploitation to see which works the best”
    DHS is using facial recognition to help rescue victims of child exploitation.
  • Anastasios Pingios at ‘xorl %eax, %eax’ provides a brief review of Michael Sikorski and Andrew Honig’s 2012 book, “Practical Malware Analysis”.
    Book: Practical Malware Analysis


  • ViperMonkey v0.06 was released with “new features and bug fixes”
    2018-03-22 v0.06
  • ExifTool v10.87 (development) was released with new tags and bug fixes.
    ExifTool 10.87

And that’s all for Week 12! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s