As always, thanks to those who give a little back for their support!

FORENSIC ANALYSIS

• Andrea Fortuna at ‘So Long, and Thanks for All the Fish’
  How to extract sysdiagnose logs for forensic purposes on iOS

• Basis Technology
  Intro to DFIR: The Divide and Conquer Process (3 hours)

• Joshua James at Digital Forensic Science
  Hex editors and data structures

• Elcomsoft
  • Apple Mobile Devices Cheat Sheet
  • Mobile Forensics: Are You Ready for iOS 14?
  • Stick It To The Man

• James Duffy
  Apple Mail – A Forensic Insight

• Joshua Hickman at ‘The Binary Hick’
  New Android Image Available.  This One Goes to 11!

• Marco Neumann at ‘Be-binary 4n6’
  • App HealthMate on Android Part 1 – Users, Messages, Devices
  • App HealthMate on Android Part 2 – Activities
  • App HealthMate on Android Part 3 – Heart Rate, GPS, Steps

• Oxygen Forensics
  Oxygen Forensic Maps Gives Investigators Control Over Time Zones

• The DFIR Report
  Ryuk’s Return
  

THREAT INTELLIGENCE/HUNTING

• Chris Brenton at Active Countermeasures
  Fixing Bro/Zeek’s Long Connection Detection Problem

• Alex Verboon at ‘Anything about IT’
  Monitoring Service principal sign-ins with AzureAD and Azure Sentinel

• Anton Chuvakin
  Why is Threat Detection Hard?

• Aon
  Into Defray

• Azure Sentinel
  • Azure Sentinel To-Go (Part2): Integrating a Basic Windows Lab 🧪 via ARM Templates 🚀
  • Build-Your-Own Machine Learning detections in the AI immersed Azure Sentinel SIEM

• Brad Duncan at Malware Traffic Analysis
  • 2020-10-06 – TA551 (Shathak) Word docs push IcedID
  • 2020-10-08 – Password-protected XLS files push ZLoader (Silent Night)

• Adrian Kress at Compass Security
  Evading Static Machine Learning Malware Detection Models – Part 1: The Black-Box Approach

• Alex Kirk at Corelight
  Beating alert fatigue with integrated data

• CyCraft Technology Corp
  Taiwan Government Targeted by Multiple Cyberattacks in April 2020

• Fatih Ozavci
  TA505+ Adversary Simulation

• Adam Johnston at DFIR Madness
  Attribution and Threat Hunting, the Missing Steps After an Incident

• Jorge Orchilles at Scythe
  SCYTHE Presents: #ThreatThursday – SlothfulMedia

• Nasreddine Bencherchali
  A Deep Dive Into RUNDLL32.EXE

• Nik Alleyne at ‘Security Nik’
  • Security On The Cheap – Beginning Elastic Stack – Installing Elastic 7.9 on Ubuntu 20.04
  • Security On The Cheap – Beginning Elastic Stack – Installing Kibana 7.9 on Ubuntu 20.04
  • Security On The Cheap – Beginning Elastic Stack – Providing Basic Security to Elastic and Kibana 7.9 communication on Ubuntu 20.04
  • Beginning Elastic – Installing and Providing Basic Security to Metricbeat – Elastic Stack 7.9 on Ubuntu 20.04
  • Beginning Elastic – Installing and Providing Basic Security to Auditbeat – Elastic Stack 7.9 on Ubuntu 20.04
  • Beginning Elastic – Installing and Providing Basic Security to Filebeat – Elastic Stack 7.9 on Ubuntu 20.04
  • Beginning Elastic – Installing, Configuring and Providing Basic Security to Packetbeat – Elastic Stack 7.9 on Ubuntu 20.04
  • Security On The Cheap – Beginning Elastic – Installing and Providing Basic Security to Winlogbeat – Elastic Stack 7.9 on Ubuntu 20.04

• NVISO Labs
  MITRE ATT&CK turned purple – Part 1: Hijack execution flow

• Oktay Yildiz at Binalyze
  New SOC Approach: Automated Incident Response

• Henri Hambartsumyan at Falcon Force
  FalconFriday — Evasive LOLBINs and burning the CACTUSTORCH — 0xFF04

• Palo Alto Networks
  • Highlights from the Unit 42 Cloud Threat Report, 2H 2020
  • Unit 42 Cloud Threat Report: Misconfigured IAM Roles Lead to Thousands of Compromised Cloud Workloads

• Sandor Tokesi at Forensics Exchange
  Find your prey – as a threat hunter

• Scott Piper at ‘Summit Route’
  Public dataset of Cloudtrail logs from flaws.cloud

• Security Art Work
  • Troyanos bancarios de moda: mekotios y grandoreiros
  • Threat hunting (IV): hunting without leaving home. Grafiki
    

UPCOMING EVENTS

• Cellebrite
  Exploring New Features with BlackLight 10.2

• MSAB
  • What’s New in XRY 9.2 & XAMN 5.2 (Oct 13)
  • What’s New in XRY 9.2 & XAMN 5.2 (Oct 14)

• Nik Alleyne at ‘Security Nik’
  SANS Stay Sharp series – Looking to further sharpen your TShark knowledge?

• Passware
  Webinar: Passware 2020 and Decryptum
  

PRESENTATIONS/PODCASTS

• Cache Up with Jessica Hyde
  Magnet Forensics Presents: Cache Up – Ep.19 – Jad Saliba

• Kevin Ripa at SANS
  • Episode 123: Registry Write Blocking – Part 4
  • Episode 124: How We Get Good
  • Episode 125: Encryption & Crypto – Part 1

• The Forensic Lunch with Dave Cowen and Matt Seyer
  Forensic Lunch 10/9/20

• AccessData
  What’s New with FTK® 7.4?

• Archan Choudhury at BlackPerl
  Understanding Windows Event Logs | Digital Forensics Case Study| Windows Event Forensics- Part2

• OSDFCon 2019
  Tools for Cloud Examination – OSDFCon 2019 – Daniel White and Thomas Chopitea

• BlackBag Technologies
  Imaging a Mac with a T2 Security Chip

• Breaking Badness podcast
  62. IoT Has Come Home to Roast

• Cellebrite
  • How The Workflow Guidance Feature In Cellebrite Responder Helps Examiners
  • Episode 10: I Beg to DFIR – Introducing the 1st Cellebrite CTF – What to Expect, How to Prepare, How to be Successful! 

• Joshua James at DFIR.Science
  • DFS101: 6.1 Data Storage
  • DFS101: 6.2 Data Structures
  • DFS101: 6.3 Data Acquisition
  • Python Programming 007 – Reading and Writing Files

• Kirtar Oza
  DFIR Mussings – Episode 1

• Lee Reiber’s Forensic Happy Hour
  Oxygen Forensics Episode 130

• Life has no CTRL ALT DEL with Heather Mahalik
  • Overview Of Network Forensics, Log Collection and Analysis
  • Testing And Validation Of Photos On An iOS Device

• Magnet Forensics
  Magnet Weekly CTF Challenge Week #1

• Matthew Toussain
  Tactics Tuesday | Bash History Tricks

• MSAB
  New release: Top 5 features in XRY 9.2, XAMN 5.2 and XEC 6.1

• NTCore
  Analyzing Windows Kernel Crash Dumps in 45 Seconds

• Nuix
  Taking Back the Host – State of the Art Endpoint Detection and Investigation

• Secureworks
  Tools and Techniques for Threat Hunting and Threat Research

• Sumuri
  RECON LAB: Highlighted User Counts

• Virus Bulletin
  VB2020 localhost is over, but the content is still available to view!
  

MALWARE

• 360 Netlab
  HEH Botnet, 一个处于开发阶段的 IoT P2P Botnet

• Alexander Jäger
  malicious-attachment-analysis-script to Timesketch with colab jupyter

• Bitdefender Labs
  • Fake Users Rave but Real Users Rant as Apps on Google Play Deal Aggressive Adware
  • LemonDuck Crypto-Miner – a KingMiner Successor
  • There’s a New a Golang-written RAT in Town

• Alex Holland at Bromium
  Droppers, Downloaders and TrickBot: Detecting a Stealthy COVID-19-themed Campaign using Toolmarks

• Warren Mercer, Paul Rascagneres and Vitor Ventura at Cisco’s Talos
  PoetRAT: Malware targeting public and private sector in Azerbaijan evolves

• Dylan Duncan and Max Gannon at Cofense
  Trump COVID-19 Diagnosis Leveraged in Campaigns

• Intezer
  Emotet Evolves but Code Remains Mostly the Same

• Pavel Shoshin at Kaspersky Lab
  Malware delivery through UEFI bootkit with MosaicRegressor

• Malwarebytes Labs
  • Mobile network operator falls into the hands of Fullz House criminal group
  • Release the Kraken: Fileless APT attack abuses Windows Error Reporting service
  • Credit card skimmer targets virtual conference platform

• Marco Ramilli
  How To Unpack Malware: Personal Notes

• Dinesh Venkatesan at Microsoft Security
  Sophisticated new Android malware marks the latest evolution of mobile ransomware

• Nasreddine Bencherchali
  BAT Downloader to Keylogger Technical Analysis — Part 1

• Ghanashyam Satpathy at Netskope
  You Can Run, But You Can’t Hide: Detecting Malicious Office Documents

• Nathaniel Quist at Palo Alto Networks
  Black-T: New Cryptojacking Variant from TeamTnT

• Paul Melson
  Analysis of MaliciousMacroMSBuild & Cobalt Strike Stager

• Proofpoint
  Employer21: Targeting Teachers with Ransomware Disguised as Class Assignments

• Proofpoint
  Employer21: Targeting Teachers with Ransomware Disguised as Class Assignments

• SANS Internet Storm Center
  • Obfuscation and Repetition, (Mon, Oct 5th)
  • Nmap 7.90 Released, (Sun, Oct 4th)
  • Today, Nobody is Going to Attack You. , (Wed, Oct 7th)
  • Phishing kits as far as the eye can see, (Fri, Oct 9th)
  • Open Packaging Conventions, (Sat, Oct 10th)

• Denis Legezo at Securelist
  MontysThree: Industrial espionage with steganography and a Russian accent on both sides

• Sucuri
  • Backdoor Shell Dropper Deploys CMS-Specific Malware
  • SiteCheck Malware Report: September Summary

• Telsy
  Operation “Space Race”: reaching the stars through professional Social Networks

• ZScaler
  • Malware Leveraging XML-RPC Vulnerability to Exploit WordPress Sites
  • Targeted Attacks on Oil and Gas Supply Chain Industries in the Middle East
  • Spear Phishing Campaign Delivers Buer and Bazar Malware

MISCELLANEOUS

• Andrew Rathbun at AboutDFIR
  • Introducing AboutDFIR’s Registry Explorer/RECmd Guide
  • AboutDFIR Content Update 10/7/2020

• Lori Tyler at AccessData
  Document review can be overwhelming. Quin-C 7.4 isn’t.

• Chris Crowley at ‘Risk, Failure, Survival’
  2020 CyberDefense Summit

• Rachel Goddard at Cyan Forensics
  Celebrating Our 4th Birthday

• Brendan Mccreesh
  Combine Excel Worksheets into One Excel Workbook

• Doug Metz at Baker Street Forensics
  • Welcome to Baker Street Forensics
  • Git ‘Er Done

• Forensic Focus
  • How To Use Optical Character Recognition In Oxygen Forensic Detective
  • How To Analyze Data From Azure VMs In Magnet AXIOM Cyber
  • Image And Video Analysis For Mobile Phone Investigations
  • How To Extract WhatsApp Data By App Downgrade Extraction Method
  • 25 Days, 25 Questions: Part 2 – Professional Digital Forensics Qualifications

• Igor Skochinsky at Hex Rays
  Igor’s tip of the week #10: Working with arrays

• Howard Oakley at ‘The Eclectic Light Company’
  • Inside the file system: 1 Disks and partitions
  • Inside the file system: 2 HFS+ volumes
  • Inside the file system: 3 APFS containers and volumes
  • Inside the file system: 4 Summary and references

• Input-Ace
  • Using the Full-Screen Feature
  • Video Forensics: The Digital Takedown of a Killer

• Magnet Forensics
  • Magnet OUTRIDER 2.0: Capture & Scan More Data with Even Faster Speed
  • Meet Magnet Forensics’ Training Team: Jerry Hewitt

• Mary Ellen Kennel at DFIRLinks
  Home

• Patrick J. Siewert at Pro Digital Forensic Consulting
  2020 Key Influencers in DFIR

• Harley Geiger at Rapid7
  Ransomware Payments and Sanctions – U.S. Treasury Advisory

• Kelley Wilds at Recon InfoSec
  Recon Launches Network Defense Range (NDR) Live Online

• Richard Bejtlich at TaoSecurity
  Greg Rattray Invented the Term Advanced Persistent Threat

• Richard Frawley at ADF
  Prepare Evidence Collection Keys for a Digital Forensic Investigation

• Lauren Cochenour at VTO Labs
  VTO Tips & Tricks: White it out

• ZecOps
  ZecOps for Mobile DFIR 2.0 – Now Supporting iOS *AND* Android

SOFTWARE UPDATES

• AccessData
  FTK Imager Version 4.5

• Ciphey
  New Ciphers + Bug Fixes

• Didier Stevens
  Update: oledump.py Version 0.0.54

• Elcomsoft
  • ElcomSoft Phone Breaker 9.63 – maintenance release
  • Elcomsoft iOS Forensic Toolkit 6.51 adds support for iOS 14
  • Elcomsoft Phone Viewer 5.20 updated for iOS 14

• Eric Zimmerman
  ChangeLog

• Metaspike
  Forensic Email Collector v3.52

• MSAB
  New release: XRY 9.2, XAMN 5.2 and XEC 6.1

• Open Source DFIR
  Plaso 20201007 released

And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!