The Forensic 4Cast nominations are closing on May 15, so get your nominations in!
Cellebrite have a post about what they want you to nominate them for, but here’s my take on some of the peoples/companies/tools that deserve a nomination.
Due to the current COVID19 pandemic, SANS has also moved *all* of their classes until June 1 to be SANS Cybercast virtual events. What does this mean? It means that you can take the class of your choosing from the comfort of your own home! No need to travel, no expense reports, no need to wear pants (which is absolutely a requirement for the live events). What this also means is that if you want to take FOR500 with me in May, then you don’t need to travel down to Sydney either. It will be in the timezone that the class was originally meant to run though so something to keep in mind before signing up to a class on the other side fo the world.
Links only again this week, slowing down a bit so I can focus on this exciting news a little more.
Thanks to Lodrina for her work on the Threat Hunting and Malware Analysis sections.
As always, Thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Jessica Hyde at Magnet Forensics
Understanding iOS time stamps
- Roey Arato at Cellebrite
Practical Guide to Huawei Device Extraction in UFED
- Dr. Neal Krawetz at ‘The Hacker Factor Blog’
- Stephen Davis at Fire Eye Threat Research
Crescendo: Real Time Event Viewer for macOS
- Jaron Bradley at The Mitten Mac
- Marcos at ‘Un minion curioso’
OP Tanjawi: Forensic Techniques on Fire – Forensic Analysis to VirtualBox
- Tony Redmon at ‘Office 365 for IT Pros’
Capturing “High-Value” Audit Events Requires Microsoft 365 Advanced Audit
- Peter Stewart
- Teru Yamazaki at Forensicist
MSSQL Forensics Series (3)
- Joe Stocker at ‘The Cloud Technologist’
Deploying MailItemsAccessed Audit Event in Office 365
THREAT INTELLIGENCE/HUNTING
- Adam at Hexacorn
- Anton Chuvakin
Road to Detection: YARA-L Examples — Part 4 of 3
- Brad Duncan at Malware Traffic Analysis
- Check Point Research
Cryptominers Dominate, Targeted Ransomware Hits Hard Shows the 2020 Cyber Security Report
- CVE-2020–0796
- Didier Stevens
CLSIDs in OLE Files
- Devin Hurley at Elasticsearch
Elastic SIEM detections
- Koen Van Impe
Integrating MISP and Cytomic Orion
- Mike at “CyberSec & Ramen”
Authoring a Sigma Rule for CSI.Exe
- Cornelis de Plaa at Outflank
Red Team Tactics: Advanced process monitoring techniques in offensive operations
- Palo Alto Networks
2020 Unit 42 IoT Threat Report
- Chris Rothe at Red Canary
What F1 racing can teach us about telemetry
- Luke Paine at SpecterOps
Through the Looking Glass — Part 1
- Satnam Narang at Tenable
COVID-19: Coronavirus Fears Seized by Cybercriminals
- TrustedSec
- Jonathan Yarema at Trustwave SpiderLabs
Persistent Cross-Site Scripting, the MSSQL Way
UPCOMING WEBINARS/CONFERENCES
- AceLab
The ACE Lab Technology Conference on Data Recovery & Digital Forensics Will Take Place Online
- Magnet Forensics
Grayshift & Magnet Forensics: Slaying iOS Investigations
PRESENTATIONS/PODCASTS
- Chris Brenton at Active Countermeasures
What Is Threat Hunting and Why Is It so Important? – Video Blog
- Black Hills Information Security
Webcast: Think You’re Compromised? What Do We Do Next?
- Brakeing Down Security Podcast
2020-009-Dave Kennedy, Offensive Tool release (Part 1)
- Cellebrite
- Digital Forensic Survival Podcast
DFSP # 212 – Learning Python
- Sarah Edwards at Mac4n6
New Presentation – Exploring macOS with APOLLO from #OBTS 3.0
MALWARE
- Check Point Research
- Sam Curry at Cybereason
Ghost in the Machine: Reconciling AI and Trust in the Connected World
- Dor Neemani, Omer Fishel, Hod Gavriel
Lost in the Maze
- Xiaopeng Zhang at Fortinet
New Variant of TrickBot Being Spread by Word Document
- Hasherezade
Trickbot
- James Haughom at Lastline Labs
IQY files and Paradise Ransomware
- Jérôme Segura at Malwarebytes Labs
Rocket Loader skimmer impersonates CloudFlare library in clever scheme
- SANS Internet Storm Centre Handler Diaries
- Not all Ethernet NICs are Created Equal – Trying to Capture Invalid Ethernet Frames, (Fri, Mar 13th)
- Anton Kivva and Igor Golovin at Securelist
Cookiethief: a cookie-stealing Trojan for Android
- Megan Roddie and Limor Kessem at Security Intelligence
PXJ Ransomware Campaign Identified by X-Force IRIS
- Phil Stokes at SentinelOne
macOS Malware Researchers | How To Bypass XProtect on Catalina
- TrendMicro
- Busting Ghostcat: An Analysis of the Apache Tomcat Vulnerability (CVE-2020-1938 and CNVD-2020-10487)
- Diana Lopera at Trustwave SpiderLabs
More Excel 4.0 Macro MalSpam Campaigns
- Virus Bulletin
- Katie Dematteis at VMware Carbon Black
2019: Looking Back at Malware
- Matthieu Faou at WeLiveSecurity
Tracking Turla: New backdoor delivered via Armenian watering holes
- Wilbur Security
Harma and Odveta Ransomware
- Yoroi
MISCELLANEOUS
- Andrew Rathbun at AboutDFIR
AboutDFIR Content Update 3/11/2020
- Lori Tyler at AccessData
KISS (Keep It Simple, Sherlock!) Your Caseload Away with the Quin-C Predesigned Forensic Workflow
- Sam Holt at AccessData
Triage in Digital Forensics
- Elan at DFIR Diva
How I’ve Been Studying for Certifications
- Forensic Focus
- Christopher Vance at Magnet Forensics
A Few Mac Artifacts You Should Be Paying Attention To
- Minoru Kobayashi
Pre-compiled libyal libraries
- Hatem Tammam at MSAB
Big Data in Digital Forensics: The challenges, impact, and solutions
- Oxygen Forensics
10 Quick Facts About Oxygen Forensic Cloud Extractor
- Michael Haag
Splunk BOTS — Setup
SOFTWARE UPDATES
- AChoir
AChoir Version 4.3+
- Didier Stevens
- KAPE
0.9.0.1 2020-03-10
- GetData
13 Mar 2020 – 5.1.2.9372
- Itay Kruk
get-injected-code
- dfir_ntfs
1.0.3
- Timesketch
20200310
- Velociraptor
Release 0.4.0
And that’s all for the week! If you think we’ve missed something, or want us to cover something specifically hit us up through the contact page or on the social pipes!
This Week In 4n6 