Think before you click. — For those of us the security industry, we’ve clearly had an insane start to October, the month of Cybersecurity Awareness. What about all those people who don’t do what we do? This article is for them. …

A beginners cheatsheet to threat hunting with Bro/Zeek. — As an extension to an earlier post on Analysing PCAPs with Bro/Zeek, I found myself last week thinking, wouldn’t it be efficient for me to keep a cheat sheet of commands I can use each time PCAP analysis is required? Well, here it is, future me, and anyone else who…

If you’re looking to get into the DFIR field, or you’ve just started, there will be a point in your career when you get asked one of the… — If you’re looking to get into the DFIR field, or you’ve just started, there will be a point in your career when you get asked one of the following: ‘My computer is acting weirdly, can you see if it’s been hacked?’ ‘This employee is complaining that their computer is slow…

My overview of the SANS Advanced Network Forensics course and certification — When you read the title of the course, “Advanced Network Forensics, Threat Hunting, Analysis, and Incident Response”, it straight out sounds intimidating. Upon choosing to take SANS FOR572 last November, there weren’t that many reviews about it aside from what was stated on the SANS website. …

Come on a journey with me as we go through a memory forensics based CTF. — One of my goals for the second half of 2019 was to improve on my memory forensics skills, and at almost too-good timing, the DEF CON DFIR CTF was released. Here’s my write-up, with some added commentary for people who are learning this fine skill like I am. …

An exploration of BSides/DEF CON: Linux hardening, linux forensics, malware hunting, and DNS Rebinding. — My first time at BSidesLV and DEF CON was in 2018, and while I was adamant that I wouldn’t go again for a short while, I found myself back there this year. It was definitely worth it, and I wanted to share what I learnt along the way. BSides LV — Pros vs Joes Every year…

An alternative method to tackling network-based CTFs and challenges. — Wireshark has always been my go-to for PCAP analysis. However recently I was exposed to the wonders of bro-cut, a fun little function of Bro IDS (now renamed to Zeek) that allows you to segregate PCAPs into Bro logs; http, dns, files, smtp and much more. Not only this, but…

The unravelling of forensic artefacts created by the Windows 10 Mail application. — While working on a forensics case, I stumbled across a folder in AppData\Local called “Comms”. Not knowing what this was at the time, I glanced through and realised that these are logs and artefacts of the Windows 10 Mail application. For this blog post, I was able to replicate the…

A series comprising of useful knowledge and resources for an infosec beginner. — In the final part to this series, I want to share something that’s very close to my heart: books. If you like reading, hop on this journey with me and explore the possibilities. If not, maybe you can recommend this list to people who do. As I’ve reinforced throughout this…