Our first (non-beta) run of the FOR308 class is running this week with Jason Jordaan at DFIRCON, very exciting!
Why did you developed the SANS FOR308:Digital Forensics Essentials course?
As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Brett Shavers at DFIR Training
Arsenal’s Bypass Data Protection API (DPAPI) - Cellebrite
- D-Virus
Análisis forense sobre archivos EnCase7 v2 (EX01) - Elcomsoft
- Hacking Articles
- Howard Oakley at ‘The Eclectic Light Company’
Quarantine and the quarantine flag - Jon Baumann at Ciofeca Forensics
- Joshua James at Digital Forensic Science
Custom artifact creation - Magnet Forensics CTF write ups
- Maxim Suhanov
The NT kernel can ignore your hardware clock during the boot - MuSecTech
- Robert Graham
hunter-dkim - Rory Wagner
FAT32 File Carving
THREAT INTELLIGENCE/HUNTING
- Secureworks
Azure Sentinel: Microsoft’s SIEM for the cloud and on-premises - Paul Schnackenburg at 4sysops
Azure Sentinel: Microsoft’s SIEM for the cloud and on-premises - Alex Verboon at ‘Anything about IT’
Deploying Defender ASR – Block persistence through WMI event subscription - Awake Security
Threat Hunting for Avaddon Ransomware - Azure Sentinel articles
- Cofense
- Bianca Soare at Heimdal Security
WannaCry Ransomware Explained - Johnny Shaw
Process Herpaderping - Jorge Orchilles at Scythe
SCYTHE Presents: Active Directory Attacks with Kerberoasting - Koen Van Impe
- Adam Pennington at MITRE ATT&CK
Bringing PRE into Enterprise - Brittany Barbehenn, Doel Santos and Brad Duncan at Palo Alto Networks
Threat Assessment: Ryuk Ransomware and Trickbot Targeting U.S. Healthcare and Public Health Sector - Red Canary
- Tim Medin at Red Siege Information Security
Detecting Kerberoasting - RiskIQ
- Ryan Kovar at Splunk
Ryuk and Splunk Detections - Secureworks
- Security Onion
Are You Seeing What I Am Netsyncing? Analyzing Netsync Activity with Security Onion 2 - Sophos
- Cyberint
njRAT Bulletin - Jose Luis Rodriguez at Threat Hunters Forge
Mapping ATT&CK Data Sources to Security Events via OSSEM ⚔️ - William Gamazo Sanchez, Aliakbar Zahravi, Elliot Cao, Cedric Pernet, Daniel Lunghi, Jaromir Horejsi, Joseph C Chen, and John Zhang at Trend Micro
Operation Earth Kitsune: A Dance of Two New Backdoors - Andrew Schwartz at TrustedSec
- WeLiveSecurity
ESET Threat Report Q3 2020 - Sudeep Singh and Sahil Antil at ZScaler
APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services
UPCOMING EVENTS
- Acelab
Free Webinar on Data Recovery for Beginners and Start-ups: the Repeated Session - Amped Software
Register For Free Webinar: Getting Started With Video Evidence - Belkasoft
Learn Belkasoft X with Belkasoft’s CEO: Exclusively for Your Country - Group IB
CyberCrimeCon 2020 - Magnet Forensics
- Virus Bulletin
VB2020 TIPS presentations: cybercrime in the DACH region and ransomware in LATAM
PRESENTATIONS/PODCASTS
- Lodrina Cherne at SANS
Keynote: The Language of Equality | SANS BIPOC in Cybersecurity Forum 2020 - The Forensic Lunch with Dave Cowen and Matt Seyer
Forensic Lunch 10/30/20 - Alexis Brignoni
Analisis de dispositivo iOS & Android utilizando iLEAPP & ALEAPP - Cache Up with Jessica Hyde
Magnet Forensics Presents: Cache Up – Ep.22 – Ryan Benson - Kevin Ripa at SANS
- AccessData
- Basis Technology
Cybersecurity Zero to Hero with CyberChef – OSDFCon 2019 – Jonathan Glass - Black Hills Information Security
BHIS | Talkin’ Bout News 2020-10-29 - Cellebrite
- Consolidated Messages in Cellebrite Physical Analyzer
- Imaging a Macintosh with T2 Security Chip
- Revealing Files of Interest
- Transform Your Border Agency With Digital Intelligence Solutions
- Ask the expert: Cellebrite Physical Analyzer – Image classifications by Matt Goeckel
- Image Classification in Cellebrite Physical Analyzer – Release Highlights
- Selective File System in Cellebrite UFED
- Accessing Public Data in Cellebrite UFED Cloud
- Image Classification in Cellebrite Reader
- DFIR.Science
- DFS101: 10.1 RAM Acquisition and Analysis
- DFS101: 10.2 Forensic Memory Acquisition in Windows – FTK Imager
- DFS101: 10.3 Forensic Memory Acquisition in Linux – LiME
- DFS101: 10.4 Digital Forensic Memory Analysis – strings, grep, and photorec
- DFS101: 10.5 Digital Forensic RAM Analysis – Volatility
- Python Programming 009 – Dictionaries
- Digital Forensic Survival Podcast
DFSP # 245 – Fetch and Execute - Ashwin Patil
GrayHat – Blue Teaming with KQL - Jorge Orchilles at Scythe
SCYTHE Presents: Episode 2: Digital Empathy in the Customer Experience (Guest Shawn M Bowen) - Lee Reiber’s Forensic Happy Hour
Oxygen Forensics Episode 133 - Life has no CTRL ALT DEL
- Magnet Forensics
- Matthew Toussain
PowerShell | The 3 Key Cmdlets - MSAB
Webinar: The Ecosystem of Mobile Forensics integrated solutions to scale up your investigations - Nothing to See Here? I Beg to DFIR
Episode 10: iBeg to DFIR – Capture the Flag - Nuix
Responding to Threat Intelligence Using Nuix Adaptive Security - Paraben Corporation
- SANS
- Raising the Tide: Driving Improvement in Security By Being a Good Human | 2020 THIR Summit
- Big Game Hunting: Major FIN threat joins the targeted ransomware-as-a-Service (RaaS) scene
- STAR Webcast: Spooky RYUKy: The Return of UNC1878
- From One Sec Guy to the Team that Saved the CISO’s Day | Threat Hunting & Incident Response Summit
- Public Speaking: Feel the Fear and Do it Anyway | BIPOC in Cybersecurity Forum 2020
- Sumuri
- Ted Smith at ‘X-Ways Forensics Video Clips’
Video 61 – Rebuilding RAID0…with LVM! - The Cyber5
Episode 30: The State of the Cyber Threat Intelligence Market
MALWARE
- 360 Core Security
北非狐（APT-C-44）攻击活动揭露 - Ruben Andrei Condor at Bitdefender Labs
An Overview of WMI Hijacking Techniques in Modern Malware - Bar Block at Deep Instinct
The Hasty Agent: Agent Tesla Attack Uses Hastebin - Cisco’s Talos
Cisco Talos Advisory on Adversaries Targeting the Healthcare and Public Health Sector - Colin Hardy
Unlocking Excel 4.0 Macro Malware - Maranda Cigna at Cybereason
Ryuk Ransomware: Mitigation and Defense Action Items - Fire Eye Threat Research
- 0xdf hacks stuff
- Igor Skochinsky at Hex Rays
Igor’s tip of the week #13: String literals and custom encodings - Intezer
TrickBot or Treat 2.0 - OA LABS
Intezer x UnpacMe Integration - Rapid7
2021 Detection and Response Planning, Part 3: Why 2021 Is the Year for SOC Automation - SANS Internet Storm Center
- SentinelLabs
- VirusTotal
VirusTotal += Gridinsoft
MISCELLANEOUS
- Andrew Rathbun at AboutDFIR
AboutDFIR Content Update 10/31/2020 - Abuse CH
Moving Forward - Adam at Hexacorn
The Alexiou Principle - Andrea Fortuna at ‘So Long, and Thanks for All the Fish’
Digital Forensic Basics: an analysis methodology flow chart - Brett Shavers
An expert is just one page in a book ahead of you - Intel 471
Alleged REvil member spills details on group’s ransomware operations - Jason Ostrom
Building Azure Cyber Ranges for Learning and Fun - Kristian Lars Larsen at Data Narro
Wisconsin Supreme Court asked to consider limits on police use of mobile phone data - Magnet Forensics
DFIR Consultants: Apply to Test Out Project Turbo! - Mike at ØSecurity
Volatility 3 Framework (v 2.0.0-beta.1) Requirements - Oxygen Forensics
Making everything recognizable with new OCR module in Oxygen Forensic® Detective - Richard Bejtlich at TaoSecurity
Security and the One Percent: A Thought Exercise in Estimation and Consequences - Ryan Campbell at ‘Security Soup’
Weekly News Roundup — October 25 to October 31 - Ryan Chapman
New Website! - Security Onion
SOFTWARE UPDATES
- Arsenal Recon
Introducing Arsenal Image Mounter v3.3.134 and DPAPI Bypass - Aurora Incident Response
v0.6.5 - Amped
Amped FIVE Update 18800: Introducing Chain Folders, Assisted Annotation Tracking and Protected PDF Reports - Cellebrite
Now Available Cellebrite Physical Analyzer and Cellebrite UFED Cloud 7.39 - Cyber Triage
Cyber Triage 2.14: Upload Your DFIR Artifacts to S3 - Eric Zimmerman
ChangeLog - ExifTool
ExifTool 12.09 - Hex Rays
IDA Pro 7.5 SP3 released - JPCERT/CC
LogonTracer v1.5 Released - Microsoft Threat Intelligence Center
MSTICPy 0.8.8 Release - Paraben Corporation
New Version 2.7 Release - Security Onion
Security Onion 2.3.2 now available! - Target
Halogen - TheHive Project
New releases for TheHive and Cortex: Elasticsearch 7 support and security fixes. - TZWorks
Oct 2020 build (package) - Ulf Frisk released MemProcFS version
Version 3.5 - USB Detective
Version 1.6.1 (10/28/2020)
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 