G0rb<p><a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> a.k.a. Learning by Burning</p>
Recent searches
No recent searches
Search options
Only available when logged in.
nerdculture.de is one of the many independent Mastodon servers you can use to participate in the fediverse.
Be excellent to each other, live humanism, no nazis, no hate speech. Not only for nerds, but the domain is somewhat cool. ;)
No bots in general. Languages: DE, EN, FR, NL, ES, IT
Administered by:
Server stats:
1.2Kactive users
nerdculture.de: About · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.3.7
#dfir
7 posts · 7 participants · 0 posts today
cyb_detective<p>DIGITAL FORENSICS GUIDE</p><p>Long and detailed guide for beginners:</p><p>- Digital Forensics Tools, Libraries, and Frameworks</p><p>- Virtualization</p><p>- File systems</p><p>- Security Tools and Frameworks</p><p>- Networking</p><p><a href="https://github.com/mikeroyal/Digital-Forensics-Guide" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/mikeroyal/Digital-F</span><span class="invisible">orensics-Guide</span></a></p><p>Contributor x.com/MikeR256 </p><p><a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dfir</span></a></p>
Alexis Brignoni :python: :donor:<p>The buttons have to be pressed but that is just the start, not the end.</p><p>Trust no tool. Thinking is a non optional requirement.</p><p>Great read: <a href="https://www.dutchosintguy.com/post/the-slow-collapse-of-critical-thinking-in-osint-due-to-ai" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">dutchosintguy.com/post/the-slo</span><span class="invisible">w-collapse-of-critical-thinking-in-osint-due-to-ai</span></a></p><p><a href="https://infosec.exchange/tags/DigitalForensics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DigitalForensics</span></a> <a href="https://infosec.exchange/tags/MobileForensics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MobileForensics</span></a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a></p>
Chris Sanders 🔎 🧠<p>Investigation Scenario 🔎</p><p>PowerShell Script Block Logging (EID 4104) reveals the pictured command was executed:</p><p>What do you look for to investigate whether an incident occurred and its extent?</p><p><a href="https://infosec.exchange/tags/InvestigationPath" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InvestigationPath</span></a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> <a href="https://infosec.exchange/tags/SOC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SOC</span></a></p>
Volexity :verified:<p>In the course of its investigations, <span class="h-card" translate="no"><a href="https://infosec.exchange/@volexity" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>volexity</span></a></span> frequently encounters malware samples written in Golang. This reflects the increase in popularity of the Golang generally, and presents challenges to reverse engineering tools.<br> <br>Today, <span class="h-card" translate="no"><a href="https://infosec.exchange/@volexity" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>volexity</span></a></span> is releasing GoResolver, open-source tooling to help reverse engineers understand obfuscated samples. <span class="h-card" translate="no"><a href="https://infosec.exchange/@r00tbsd" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>r00tbsd</span></a></span> & Killian Raimbaud presented details at INCYBER Forum earlier today.<br> <br>GoResolver uses control-flow graph similarity to identify library code in obfuscated code, leaving analysts with only malware functions to analyze. This saves time & speeds up investigations!<br> <br>Check out the blog post on how GoResolver works and where to download it: <a href="https://www.volexity.com/blog/2025/04/01/goresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">volexity.com/blog/2025/04/01/g</span><span class="invisible">oresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically/</span></a><br> <br><a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dfir</span></a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>reversing</span></a> <a href="https://infosec.exchange/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malwareanalysis</span></a></p>
13reak :fedora:<p>Security tips of the day:</p><ul><li><p>logs only need to be stored 3 days, that's enough to cover a weekend</p></li><li><p>if you don't store backups, you also don't need to restore them</p></li><li><p>having less internal defenses decreases how long an attack takes, so you're back online faster</p></li><li><p>domain-join everything (especially firewalls and backups) to decrease dwell time of attackers</p></li><li><p>antivirus logs should never be monitored to reduce workload of analysts</p></li><li><p>never publish vulnerabilities: if no one knows about them, no one can exploit them ever.</p></li></ul><p>For more security tips, follow my Tesla account.</p><p><a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dfir</span></a> <a href="https://infosec.exchange/tags/aprilfools" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>aprilfools</span></a> <a href="https://infosec.exchange/tags/april1" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>april1</span></a> <a href="https://infosec.exchange/tags/april1st" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>april1st</span></a></p>
G0rb<p>Es gibt einfach eine negative Korrelation zwischen der Größe des "Vertraulich"-Schriftzugs auf dem Cover und der Qualität des selbigen Forensikreports.</p><p><a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a></p>
RDP Snitch<p>2025-03-28 RDP <a href="https://infosec.exchange/tags/Honeypot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Honeypot</span></a> IOCs - 181569 scans<br>Thread with top 3 features in each category and links to the full dataset<br><a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSec</span></a></p><p>Top IPs:<br>138.199.24.6 - 91545<br>156.146.57.110 - 42849<br>156.146.57.52 - 10716</p><p>Top ASNs:<br>AS60068 - 93561<br>AS212238 - 64269<br>AS135161 - 10653</p><p>Top Accounts:<br>hello - 181455<br>Test - 33<br>eltons - 15</p><p>Top ISPs:<br>DataCamp Limited - 93561<br>Datacamp Limited - 64269<br>GMO-Z.COM PTE. LTD. - 10653</p><p>Top Clients:<br>Unknown - 181569</p><p>Top Software:<br>Unknown - 181569</p><p>Top Keyboards:<br>Unknown - 181569</p><p>Top IP Classification:<br>hosting & proxy - 160374<br>hosting - 10710<br>Unknown - 10440</p><p>Pastebin links with full 24-hr RDP Honeypot IOC Lists:<br><a href="https://pastebin.com/BiF6s8Jh" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">pastebin.com/BiF6s8Jh</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/CyberSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSec</span></a> <a href="https://infosec.exchange/tags/SOC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SOC</span></a> <a href="https://infosec.exchange/tags/Blueteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Blueteam</span></a> <a href="https://infosec.exchange/tags/SecOps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SecOps</span></a> <a href="https://infosec.exchange/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Security</span></a></p>
Mike Sheward<p>Mini Blue Team Diaries story: </p><p>There was a break-in over the weekend at one of our US offices. We occupied one floor of a shared office building, and two crooks managed to get in by going to an open floor above ours and breaking a lock on the fire escape.</p><p>Rather brilliantly, a building security guard was doing rounds and actually caught the pair stuffing iPads from conference rooms into a rucksack. However, when challenged they claimed to be employees and were left alone.</p><p>Anyway they ended up with about a half dozen iPads from Zoom rooms. Annoying but not the end of the world.</p><p>Those iPads were clearly sold on, as they were connected to an MDM server and started to pop up in locations all over the city over the course of the next week.</p><p>One of them was especially interesting. Because it was connected to our MDM Apple ID, it was syncing files to iCloud. This included photos. We noticed a lot of selfies of one particular dude show up. The dude looked a lot like one of the guys who we’d seen in our office on our security cameras. Yup.</p><p>We of course passed on all the information, including the location of the selfie generating iPad, to law enforcement.</p><p>I wish there was a more interesting ending - but they never followed up on the lead, of course. So the iPads lived on, slowly filling up with various photos and memories from the crook and the people they’d been sold on to.</p><p>Read more, slightly less mini stories, at infosecdiaries.com</p><p><a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/InfoSecDiaries" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSecDiaries</span></a> <a href="https://infosec.exchange/tags/BlueTeam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>BlueTeam</span></a></p>
G0rb<p><a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintel</span></a> Webserver-Logs of Edge-Devices are really helpful sometimes.</p><p>Same with SMB-Server-Security Logs and EventID 551.</p>
Chris Sanders 🔎 🧠<p>Investigation Scenario 🔎</p><p>You’ve received an alert derived from a Sigma rule indicating a short name path was used in the command line.</p><p>Sigma Rule Source: <a href="https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/SigmaHQ/sigma/blob/</span><span class="invisible">master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml</span></a></p><p>What do you look for to investigate whether an incident occurred?</p><p><a href="https://infosec.exchange/tags/InvestigationPath" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InvestigationPath</span></a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> <a href="https://infosec.exchange/tags/SOC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SOC</span></a></p>
G0rb<p>Got my first Thai-Massage. Best 50€ investment since purchasing a <span class="h-card" translate="no"><a href="https://infosec.exchange/@malcat" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>malcat</span></a></span> Full-License.</p><p><a href="https://infosec.exchange/tags/selfcare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>selfcare</span></a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dfir</span></a></p>
Easty<p>Seen a lot of hype about this Trend Micro blog, but im not sure I can get on board with it. The whole thing seems a bit of a stretch. </p><p>Whether there are blank characters or line breaks doesn't change how the technique works, its only prevents a user easily spotting it via the lnk file </p><p>The push on zero day, vulnerability, 1000s of instances across multiple 'APTs' is a bit much and comes across as marketing hype too. </p><p><a href="https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">trendmicro.com/en_us/research/</span><span class="invisible">25/c/windows-shortcut-zero-day-exploit.html</span></a></p><p><a href="https://infosec.exchange/tags/incidentresponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>incidentresponse</span></a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dfir</span></a></p>
Hal Pomeranz<p>Fun Linux DFIR question for you! You're looking at your SSH logs and you find a root login using pubkey auth:</p><p>2025-03-20T07:44:00-0400 labpc sshd[15420]: Accepted publickey for root from 10.1.1.5 port 46698 ssh2: ED25519 SHA256:6ynkM0+FOrHtoQlkPOOQ415tvRGdBaBEMs2KWtGB1Bo</p><p>There are multiple keys in /root/.ssh/authorized keys. How can you tell which one was used for this login?</p><p><a href="https://infosec.exchange/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Linux</span></a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a></p>
G0rb<p>I hope all these european <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> Teams start analyzing all these american APTs. Could get interesting pretty fast :ablobcatlurk: </p><p>Especially when virustotal belongs to an american company.</p>
Forensic Focus<p>How can we create a healthier, more supportive environment for DFIR professionals handling difficult content every day? <a href="https://www.forensicfocus.com/podcast/protecting-investigators-dr-michael-bourke-on-building-a-healthier-dfir-community/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">forensicfocus.com/podcast/prot</span><span class="invisible">ecting-investigators-dr-michael-bourke-on-building-a-healthier-dfir-community/</span></a> <a href="https://dfir.social/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> <a href="https://dfir.social/tags/DigitalForensics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DigitalForensics</span></a> <a href="https://dfir.social/tags/mentalhealth" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mentalhealth</span></a></p>
Niels Heinen<p>It's just crazy how phpmyadmin mass exploitation remains popular (read: effective) to this day. The only developments I have seen in these exploit attempt is that the list of locations that are checked for phpmyadmin installations gets longer and more creative. </p><p>Other than that: pretty boring stuff</p><p><a href="https://infosec.exchange/tags/honeypot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>honeypot</span></a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dfir</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a></p>
Forensic Focus<p>Supporting DFIR professionals helps retain talent and avoids the high cost of turnover. <a href="https://www.forensicfocus.com/podcast/protecting-investigators-dr-michael-bourke-on-building-a-healthier-dfir-community/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">forensicfocus.com/podcast/prot</span><span class="invisible">ecting-investigators-dr-michael-bourke-on-building-a-healthier-dfir-community/</span></a> <a href="https://dfir.social/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> <a href="https://dfir.social/tags/DigitalForensics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DigitalForensics</span></a> <a href="https://dfir.social/tags/mentalhealth" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mentalhealth</span></a></p>
Forensic Focus<p>How can we proactively support mental resilience in DFIR before challenges take a toll? <a href="https://www.forensicfocus.com/podcast/protecting-investigators-dr-michael-bourke-on-building-a-healthier-dfir-community/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">forensicfocus.com/podcast/prot</span><span class="invisible">ecting-investigators-dr-michael-bourke-on-building-a-healthier-dfir-community/</span></a> <a href="https://dfir.social/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> <a href="https://dfir.social/tags/DigitalForensics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DigitalForensics</span></a> <a href="https://dfir.social/tags/mentalhealth" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mentalhealth</span></a></p>
Forensic Focus<p>Heavy cases? Try closing your DFIR workday with lighter tasks to protect your mental health. What’s your go-to routine? <a href="https://www.forensicfocus.com/podcast/protecting-investigators-dr-michael-bourke-on-building-a-healthier-dfir-community/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">forensicfocus.com/podcast/prot</span><span class="invisible">ecting-investigators-dr-michael-bourke-on-building-a-healthier-dfir-community/</span></a> <a href="https://dfir.social/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DFIR</span></a> <a href="https://dfir.social/tags/DigitalForensics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DigitalForensics</span></a> <a href="https://dfir.social/tags/mentalhealth" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mentalhealth</span></a></p>
ExploreLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload