DFIR

Windows Security Log Quick Reference

by
This entry is part 20 of 25 in the series Threat Detection Engineering

Views: 3🛡️ For Cybersecurity Defensive Operations and IR/Threat Hunting 🔐 Authentication Events 🗝️ Account Management Events 📂 Object Access Events ✅ Note: Requires enabling object auditing via GPO and SACLs. 🧰 Privilege Use and Logon Types PRO Tip: Use Logon Type + Event 4624/4625 to spot RDP logins, scheduled tasks, or lateral movement attempts. ⚙️ … Read more

Hunting the hunters: DFIR with Velociraptor (PART-II)

by
This entry is part 14 of 4 in the series Digital Forensics and Incident Response

Views: 35We covered the deployment of Velociraptor Server and Client components in the first part of this series. You can read it here if you’re interested. This part of the series will walk you through the capabilities and features of Velociraptor. Exploring the Clients from the Server GUI Searching for Clients The option “Show All” … Read more

Hunting the hunters: DFIR with Velociraptor (PART-I)

by
This entry is part 13 of 4 in the series Digital Forensics and Incident Response

Views: 70Introduction In the ever-evolving world of Digital Forensics and Incident Response (DFIR), having a powerful tool at your disposal is essential. Velociraptor stands out as an advanced, open-source endpoint monitoring, digital forensics, and cyber response platform. Developed by DFIR professionals, it empowers teams to hunt for specific artifacts and monitor activity across a fleet … Read more

Wireshark 101 | Traffic Analysis and Investigation (PART 04)

by
This entry is part 17 of 17 in the series Incident Response and Forensics

Views: 24Encrypted Protocol Analysis: Decrypting HTTPS When investigating web traffic, analysts often run across encrypted traffic. This is caused by using the Hypertext Transfer Protocol Secure (HTTPS) protocol for enhanced security against spoofing, sniffing and intercepting attacks. HTTPS uses TLS protocol to encrypt communications, so it is impossible to decrypt the traffic and view the … Read more

Concepts of Forensic Imaging

by
This entry is part 1 of 4 in the series Digital Forensics and Incident Response

Views: 16Core Concepts The process of imaging a disk starts by identifying the target drive, preparing it for imaging, and then creating the image file which is later verified for integrity. This needs to be performed in an environment that allows us to perform these tasks and also ensures the process is properly logged. Each … Read more

Incident Response

by
This entry is part 12 of 4 in the series Digital Forensics and Incident Response

Views: 8Incident response, also known as incident handling, is a cyber security function that uses various methodologies, tools and techniques to detect and manage adversarial attacks while minimizing impact, recovery time and total operating costs. Addressing attacks requires containing malware infections, identifying and remediating vulnerabilities, as well as sourcing, managing, and deploying technical and non-technical … Read more