As always, thanks to those who give a little back for their support!

FORENSIC ANALYSIS

• Bohops
  Analyzing and Detecting a VMTools Persistence Technique
  
  
• Cellebrite
  Computer Forensics: What Can You Do About Deleted Data?
  
  
• Kamala Kannan at Checkmate
  Windows Timeline: Putting the what & when together
  
  
• Craig Wilson at Digital Detective
  Forensic Analysis of the Zone.Identifier Stream
  
  
• Brendan Mccreesh
  Swimming in the SRUM
  
  
• Forensafe
  • Investigating Outlook Windows Application
  • Investigating Paint MRU
  • Investigating Windows Calendar
    
    
• Forensic-Research
  • [논문리뷰] Windows 10에서의 심캐시(ShimCache) 구조 분석과 안티포렌식 도구 실행 흔적 탐지 도구 제안
  • ShimCache Structure Analysis
    
    
• Dray Agha at Jumpsec Labs
  PowerShell Jobs
  
  
• Kathryn Hedley at Khyrenz
  USB connections with no logged-in user
  
  
• Kevin Pagano at Stark 4N6
  • Cellebrite CTF 2021 – Heisenberg’s Android
  • Cellebrite CTF 2021 – Beth’s iPhone
  • Cellebrite CTF 2021 – Marsha’s iPhone
  • Cellebrite CTF 2021 – Marsha’s Backup
  • Cellebrite CTF 2021 – Marsha’s PC
    
    
• Korstiaan Stam at ‘Invictus Incident Response’
  Responding to a Cobalt Strike attack — Part III
  
  
• Kyle Song
  • Blog #30: Why we need Deep Learning in Video Forensics [KR]
  • Blog #30: Why we need Deep Learning in Video Forensics [EN]
    
    
• Nasreddine Bencherchali
  Windows 11 “New” ETW Providers — Overview
  
  
• Amber Schroader at Paraben Corporation
  What is Android ADB with smartphone forensics?
  
  
• Eric Capuano and Whitney Champion at Recon InfoSec
  Scaling Enterprise Forensic Timelining
  
  
• Scott Koenig at ‘The Forensic Scooter’
  iOS KnowledgeC.db Notifications
  
  
• Security Onion
  • Quick Malware Analysis: Hancitor and Cobalt Strike pcap from 2021-09-29
  • Quick Malware Analysis: GOZI/IFSB/URSNIF and Raccoon Stealer pcap from 2021-09-23
  • Quick EVTX Analysis: Atomic Red Team
    
    
• The DFIR Report
  BazarLoader and the Conti Leaks
  
  
• WhyNotSecurity
  A tool to find Windows registry files in a blob of data
  

THREAT INTELLIGENCE/HUNTING

• Adam at Hexacorn
  Trololololobin and other lolololocoasters
  
  
• Anomali
  • Inside TeamTNT’s Impressive Arsenal: A Look Into A TeamTNT Server
  • Making the Case for a Threat Intelligence Platform
    
    
• Blackberry
  • Drawing a Dragon: Connecting the Dots to Find APT41
  • Threat Thursday: BluStealer Infostealer
    
    
• Brad Duncan at Malware Traffic Analysis
  2021-10-07 – Qakbot (Qbot) obama111 with Cobalt Strike
  
  
• Greg Gaylor at Censys
  Censys Blue Team Series: How to Increase Network Alert Triage Efficiency with Censys ASM’s Outside-In Visibility
  
  
• Cisco’s Talos
  • Threat hunting in large datasets by clustering security events
  • Threat Roundup for October 1 to October 8
    
    
• Countercraft
  Five Cool TTPs for Autumn
  
  
• Cybereason
  How Do Initial Access Brokers Enable Ransomware Attacks?
  
  
• Kit Clelford at Cyjax
  Ransomware Review – September 2021
  
  
• Flashpoint
  REvil Continues Its Reemergence, Joins Groove-led RAMP Forum
  
  
• Fortinet
  • Ransomware Impact on the Education Sector
  • Ransomware Survey Review with a CISO Lens
    
    
• Lina Lau at Inversecos
  Hunting for Citrix Netscaler API Abuse: Reconnaissance, SSO and Session Manipulation
  
  
• Peter Renals at Palo Alto Networks
  SilverTerrier – Nigerian Business Email Compromise
  
  
• Felipe Naves, Adam Mcneil, and Andrew Conway at Proofpoint
  Mobile Malware: TangleBot Untangled
  
  
• Tom Sellers at Rapid7
  For Microsoft Exchange Server Vulnerabilities, Patching Remains Patchy
  
  
• ReaQta
  Conti Ransomware (RaaS): A New Wage-Paying Affiliate Model
  
  
• Recorded Future
  Illegal Activities Endure on China’s Dark Web Despite Strict Internet Control
  
  
• Red Alert
  Monthly Threat Actor Group Intelligence Report, August 2021
  
  
• RiskIQ
  Mana Tools: A Malware C2 Panel with a Past
  
  
• S2W Lab
  • [SoW] W1 Oct | EN | Story of the week: Ransomware on the Darkweb
  • Prometheus x Spook: Prometheus ransomware rebranded Spook ransomware.
    
    
• SANS Internet Storm Center
  • Facebook Outage: Yes, its DNS (sort of). A super quick analysis of what is going on., (Mon, Oct 4th)
  • Video: CVE-2021-40444 Maldocs: Extracting URLs, (Sun, Oct 3rd)
  • Looking Glasses: Debugging Network Connectivity Issues, (Tue, Oct 5th)
  • Who Is Hunting For Your IPTV Set-Top Box?, (Thu, Oct 7th)
  • Sorting Things Out – Sorting Data by IP Address, (Fri, Oct 8th)
  • Scanning for Previous Oracle WebLogic Vulnerabilities, (Sat, Oct 9th)
    
    
• Security Investigation
  • Windows Service Creation and Malware Detection Methods
  • Threat Hunting Using Windows Scheduled task
  • Logon Tracer – Investigate & Visualize Malicious Windows Logon
    
    
• Sophos
  • Atom Silo ransomware actors use Confluence exploit, DLL side-load for stealthy attack
  • Python ransomware script targets ESXi server for encryption
    
    
• Matt Hand and Emily Leidy at SpecterOps
  Life is Pane: Persistence via Preview Handlers
  
  
• Cassie Doemel
  SANS Threat Hunting 2021 Start.Me
  
  
• Team Cymru
  Collaborative Research on the CONTI Ransomware Group
  
  
• Drew Kirkpatrick at TrustedSec
  • Persistence Through Service Workers—Part 1: Introduction and Target Application Setup
  • Persistence Through Service Workers—Part 2: C2 Setup and Use
    
    
• Vicente Díaz at VirusTotal
  Ransomware in a global context
  

UPCOMING WEBINARS/CONFERENCES

• Griffeye
  Webinar: Uncover critical evidence with LACE Carver
  
  
• Magnet Forensics
  Tips & Tricks // Building Streamlined Digital Forensics Workflows with Magnet AUTOMATE
  

PRESENTATIONS/PODCASTS

• Archan Choudhury at BlackPerl
  Incident Response Training Course, Network Forensics, Day 13
  
  
• Belkasoft
  Step-by-Step of an iOS Agent Based Acquisition—7th episode of BelkaTalk on DFIR
  
  
• Black Hills Information Security
  • BHIS – Talkin’ Bout [infosec] News 2021-10-04
  • BHIS | Getting Started in Covert .NET Tradecraft for Post-Exploitation – Kyle Avery
    
    
• Breaking Badness
  99. Time to Break a Threat
  
  
• BSides Singapore
  BSides Singapore Conference 2021
  
  
• Cellebrite
  • Cellebrite Capture the Flag Event – Part 2: Hints, Formats, and Details to Consider
  • New Cellebrite Guardian – Evidence and Workflow Management Redefined
  • How to Leverage the Screen Capture Feature beyond Physical Analyzer
    
    
• Cisco’s Talos
  Talos Takes Ep. #71 (NCSAM edition): Reflecting on ransomware in 2021
  
  
• Cloud Security Podcast by Google
  EP34 Instrumenting Modern Application Stack for Detection and Response
  
  
• Cybereason
  Malicious Life Podcast: Inside the MITRE ATT&CK Framework
  
  
• DFIR.Science
  • Physical Image and Partition Mounting in Tsurugi Linux
  • Contributing to open source projects – Tsurugi Linux
    
    
• Dr Ali Hadi
  • 38-Working with 010 Templates – PE File (Part #10)
  • 39-Working with 010 Templates – PE File (Part #11)
  • 40-Working with 010 Templates – PE File (Part #12)
  • 41-Reviewing 010 Template for PE File Format & How RVA to FOA is Calculated
    
    
• Gerald Auger at Simply Cyber
  Exactly What Job SPEAKS to You in Cybersecurity? (Find your Passion)
  
  
• InfoSec_Bret
  • InfoSec Tools – VirusTotal
  • InfoSec Tools – VirusTotal PART 2
    
    
• John Hammond
  SnykCon CTF – “Invisible Ink” Prototype Pollution
  
  
• MSAB
  New release: XRY 9.6, XAMN 6.2, XEC 6.5 and KTE (our frontline solutions)
  
  
• NTCore
  20-Seconds Excel Malware Analysis
  
  
• OALabs
  Analyzing Hancitor DLL Live – Let’s Build A Config Extractor!
  
  
• SANS Institute
  • Identifying & Countering Cognitive Bias
  • Vulnerability Prioritization: Peeling Back the Layers
  • Introduction to Security Architecture
  • Job Role Spotlight: Insert $2 For an Offensive Security Career
    
    
• Security Onion
  Security Onion Conference 2021 recordings are now available!
  
  
• This Week In 4n6
  This Month In 4n6 – September – 2021
  

MALWARE

• 0xjxd
  SquirrelWaffle – From Maldoc to Cobalt Strike
  
  
• Abdallah Elshinbary
  WinDbg Cheat Sheet
  
  
• Erik Pistelli at Cerbero
  Video: 20-Seconds Excel Malware Analysis
  
  
• Chuong Dong at 0ffset
  SQUIRRELWAFFLE – Analysing The Main Loader
  
  
• Tom Fakterman, Daniel Frank, Chen Erlich, and Assafassaf Dahan at Cybereason
  Operation GhostShell: Novel RAT Targets Global Aerospace and Telecoms Firms
  
  
• Cyberint
  Vidar Stealer Abuses Mastadon Social Network
  
  
• Igor Skochinsky at Hex Rays
  Igor’s tip of the week #59: Automatic function arguments comments
  
  
• Shusei Tomonaga at JPCERT/CC
  Malware Gh0stTimes Used by BlackTech
  
  
• MWLab
  • Malware Analysis Tools, Part 1
  • Malware Analysis Tools, Part 2
    
    
• Gustavo Palazolo and Ghanashyam Satpathy at Netskope
  SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot
  
  
• nullteilerfrei
  Using Windows Sandbox for Malware Analysis
  
  
• Runa Sandvik at Objective-See
  Made In America: Green Lambert for OS X
  
  
• Paolo Luise at Any.Run
  Using a Sandbox for Incident Response: Containment Strategy
  
  
• Fedor Sinitsyn and Yanis Zinchenko at Securelist
  Ransomware in the CIS
  
  
• Pedro Tavares at Segurança Informática
  Malware analysis: Details on LockBit ransomware
  
  
• Muthamil Mudhalvan
  PE Format
  
  
• Siddharth Sharma at Uptycs
  Team TNT Deploys Malicious Docker Image On Docker Hub
  
  
• Vladislav Hrčka at WeLiveSecurity
  FontOnLake: Previously unknown malware family targeting Linux
  

MISCELLANEOUS

• Amped
  • How Can I Zoom, Blur, or Spotlight a Moving Object in Amped Replay?
  • Can AI be used for forensics and investigations?
    
    
• Vitaliy Mokosiy at Atola
  Locate Sectors in Atola Insight Forensic 5.1
  
  
• ArcPoint Forensics
  Installing Autopsy on macOS Big Sur
  
  
• Binary Recon
  BitLocker – AD setup for BitLocker Recovery Key Management
  
  
• Cassie Doemel at AboutDFIR
  AboutDFIR Content Update 10/09/2021
  
  
• Forensic Focus
  • Using Network Capture with Binalyze AIR
  • LogExtractor: Extracting Digital Evidence From Android Log Messages Via String & Taint Analysis
  • Detego Delivers Exceptional Airport Security with Unified Digital Investigations
  • New release from MSAB: XRY 9.6, XAMN 6.2 and XEC 6.5
  • Password Protecting XRY Files
  • Streamlining the FTK Workflow With Portable Cases
  • Insider Threat Prediction Based on Unsupervised Anomaly Detection Scheme for Proactive Forensic Investigation
  • Access Achieved: Keep the Integrity of your Mobile Evidence
    
    
• iNPUT-ACE
  What does a Forensic Video Analyst really do for a Police Agency?
  
  
• Magnet Forensics
  Kick Off Cybersecurity Awareness Month with Our New White Paper!
  
  
• Oxygen Forensics
  Innovative data recovery
  
  
• Derya Yavuz at Praetorian
  How to Write and Execute Great Incident Response Playbooks
  
  
• Carlos Canto at Rapid7
  Velociraptor to Announce Winners of Its 2021 Contributor Competition
  
  
• Ryan Campbell at ‘Security Soup’
  Weekly News Roundup — October 3 to October 9
  
  
• SANS
  • The NEW ICS418 Course: Step Up, Step Over, In Place – ICS Security Essentials for Managers
  • Securing Your Family in Today’s Digital World
  • A Visual Summary of SANS Threat Hunting Summit 2021
  • How to Banish SOC Analyst Burnout
    
    
• SentinelOne
  • Understanding the Difference Between EDR, SIEM, SOAR, and XDR
  • Massive Attack | Why MSPs Are Prime Targets for Cybercriminals and APTs
    

• Pieter Arntz at Malwarebytes Labs
  At long last, Microsoft is disabling Excel 4.0 macros by default

SOFTWARE UPDATES

• Amped
  Amped Replay Update 22229: New Timestamp Functions, Annotation Options, and Increased Admin Settings
  
  
• ANSSI DFIR-ORC
  v10.0.21
  
  
• Belkasoft
  Belkasoft Releases Belkasoft T v.1.1
  
  
• Brim
  v0.26.0
  
  
• Costas K
  • BitmapReader
  • MFTBrowser.exe (x64)
    
    
• Digital Detective
  • HstEx® v5.1 Released
  • NetAnalysis® v3.1 Released
    
    
• Eric Zimmerman
  ChangeLog
  
  
• Maxim Suhanov
  dfir_ntfs 1.0.10
  
  
• Mihari
  v3.9.2
  
  
• MSAB
  New release: XRY 9.6, XAMN 6.2 and XEC 6.5
  
  
• Security Onion
  Introducing Security Onion Solutions Response-Ready (R2) Appliances!
  
  
• SOF-ELK
  SOF-ELK® Virtual Machine Changelog
  

And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!