Write-ups on digital forensics, incident response and memory analysis. Browse by topic with the categories in the sidebar, or subscribe via RSS to hear about new posts.
An adversary-in-the-middle (AiTM) alert fires on a user. The account is disabled and the password reset, then the incident is marked contained. Twenty minutes later a sign-in from another country is still reading the mailbox, and a payment redirect is already in flight.
The Australian Cyber Security Centre released a "simulated cyber security challenge" which was first used at a security conference called BSides Canberra 2021. It is an awesome challenge to have a go at and provides questions and answers so you can test your knowledge. The challenge can be found here.
Threat Intelligence is information about threats, threat actors and indicators of compromise that assist cybersecurity teams and individuals prepare against attacks, understand trends and what tactics threat actors used or are currently using
It's only a matter of time before you are involved with a cybersecurity incident. That's not fear-mongering, that's the truth. Businesses and organisations that respect this will be at the forefront of planning to prevent it, but even the most prepared are fallible and adversaries are evolving on a day-to-day basis.
Something I came across recently in an incident response engagement was the potential use of "Cipher.exe". Let's take a look at how it works. The testing site is on an exFAT USB but in-depth analysis regarding the exFAT process of deleting files etc will not be discussed today but more so focussed on what Cipher.exe does to the file instead.
I'm guessing you already know what it is if you are here but I like to keep these articles as informational as possible for everyone interested to read them.
File carving refers to a process used in Digital Forensics to recover data from a file system which has typically been deleted. File carving can be automated using software or done so manually. The sign of a good Digital Forensics practitioner is the ability to do this manually or at the minimum understand how this process is carried out when using forensic programs that can do it for you.
The idea of this article is to provide an overview of FTK Imager and some of the features it has and how to use them. You can download FTK Imager for free from https://accessdata.com/products-services/forensic-toolkit-ftk/ftkimager and view the documentation at https://support.accessdata.com/hc/en-us/articles/204056525-FTK-User-Guide.
The idea of this article is to provide an overview of Wireshark and some of the features it has and how to use them. You can download Wireshark for free from https://www.wireshark.org/ and view the documentation at https://www.wireshark.org/docs/.