2016

May 10, 2016 » Go Prefetch Yourself

execution   fls   indxparse   jinja   memory forensics   prefetch   python   tsk   volatility

2014

Apr 18, 2014 » Rewriting/Anonymizing Artifacts

dfir   forensics   memory forensics   pcap   python   scapy   volatility

Mar 12, 2014 » Bruteforcing XOR with YARA

MACB   XOR   XtremeRAT   YARA

2013

Dec 3, 2013 » AnalyzePDF - Bringing the Dirt Up to the Surface

AnalyzePDF   PDF   YARA   malware   python

Nov 11, 2013 » OMFW & OSDFC recap

OMFW   OSDFC   forensics   memory forensics   volatility

Jun 26, 2013 » Don't Get Locked Out

FDE   Kon-Boot   Ophcrack   SafeBoot   Sticky Keys   WinTech   encryption

Jan 22, 2013 » NoMoreXOR

XOR   YARA   frequency analysis   malware   python

2012

Oct 1, 2012 » dbmgr reloaded

MACB   ThreatExpert   avsubmit   dbmgr   mutant   mutex

Sep 19, 2012 » SWF-ing away

0-day   Adobe Flash   OllyDbg   SWF   XOR   doSWF   xxxswf

Jul 17, 2012 » Customizing cuckoo to fit your needs

CaptureBAT   ClamAV   Cymru   HoneyD   INetSim   MACB   VirtualBox   VirusTotal   YARA   cuckoo   hachoir-subfile   libpff   malware   pdfextract   pffexport

Jul 2, 2012 » Is that an Infection or a False Positive?

CFF Explorer   ClamAV   HxD   ZeuS   anti-virus   commodity malware   hash   pescanner   sigtool

Jun 21, 2012 » Getting what you want out of a PDF with REMnux

PDF   REMnux   hachoir-subfile   pdfxray_lite   peepdf

Jun 19, 2012 » XDP files and ClamAV

ClamAV   PDF   TrID   TrIDScan   XDP   YARA   classification   dfir   malware

May 9, 2012 » What's in your logs?

dfir   log analysis   log2timeline

Apr 30, 2012 » Let Me In

bash   dfir   firewire   ftwautopwn   inception   libforensic1394   scripting

Apr 25, 2012 » Deobfuscating JavaScript with Malzilla

JavaScript   Malzilla   dfir   malware

Apr 19, 2012 » YARA + Volatility ... the beginning

ClamAV   REMnux   YARA   bash   pescanner   python   scripting   volatility

Mar 26, 2012 » Making Volatility Work for You

dfir   memory forensics   volatility

Feb 13, 2012 » What to use for analysis on a per file extension -or- category basis

analysis   classification   dfir   malware

Jan 9, 2012 » Total number of connections to a server from proxy logs

awk   bash   grep   log analysis   perl   proxy   scripting   sed