Digital Forensic Survival Podcast

Digital Forensic Survival Podcast episodes:

• 06.25.2024

  DFSP # 436 - Ja-Who?

  The JOHARI methodology simply provides a structure for something that you're probably already doing. However, with the structure comes a standard, which is the benefit to any security team. The team should be speaking the same language, especially in fast...

  
• 06.18.2024

  DFSP # 435 - Good Ol’ Powershell

  Threat actors often exploit PowerShell in cyber attacks due to its capabilities and integration with Windows operating systems. Microsoft has cited powershell as one of the most commonly used tools in the attack chain. It also comes up in phishing...

  
• 06.11.2024

  DFSP # 434 - The Reg

  The Windows registry is a hierarchical database that stores configuration settings and options on Microsoft Windows operating systems. It contains settings for low-level operating system components as well as for applications running on the platform. In order to make use of...

  
• 06.04.2024

  DFSP # 433 - SU DOs and DONTS

  On a Linux or Mac system, there can be user accounts that have the ability of privilege escalation. Knowing how to triage, for this has a twofold benefit: (1) you obviously want to know which account may elevate to route...

  
• 05.28.2024

  DFSP # 432 - Control Bits

  TCP control bits are part of the TCP header and are used to manage the connection between two devices. These control bits are single-bit flags that indicate various aspects of the TCP connection and are important for understanding and analyzing...

  
• 05.21.2024

  DFSP # 431 - Finding Needles

  The time it takes from an initial escalation to the initial discovery of compromise is a key metric. Teams strive to do this as quickly as possible, but there are a number of challenges. You do not know what you're...

  
• 05.14.2024

  DFSP # 430 - Targeting Tasks

  Windows Scheduled Tasks are often used by attackers to establish persistence. As an analyst, you want to be aware of the different windows event codes that record these details. These artifacts come up in just about every windows compromise assessment,...

  
• 05.07.2024

  DFSP # 429 - Career Moves

  This week I talk about career moves for the DFIR professional. The skill set is valuable, but it must be combined with the right additional technical skills to maximize future job opportunities. Of course, there is one skill set that...

  
• 04.30.2024

  DFSP # 428 - It’s all about that XML

  When you're triaging a Windows system for evidence of compromise, it's ideal if your plan is focused on some quick wins upfront. There are certain artifacts that offer this opportunity, and Windows Events for New Scheduled Tasks are one of...

  
• 04.23.2024

  DFSP # 427 - MOF Balls

  Windows management instrumentation, also known as WMI, is an App on Windows that allows a user to query all sorts of things about a system. Being native to Windows, it is an attractive target for a attackers to leverage. This...

  
• 04.16.2024

  DFSP # 426 - SSH Forensics: Log Analysis

  This week I'm wrapping up my series on SSH forensics with a discussion on SSH log triage. Logs are usually what an analyst will start with, so this episode is important. There are a few different log types, and there...

  
• 04.09.2024

  DFSP # 425 - SSH Forensics: Host-Based Artifacts

  In the last episode on this topic, I covered SSH from a investigation point of view. I explained SSH and the artifacts that typically come up when your investigating. In this episode, we're getting into the triage methodology. This includes...

  
• 04.02.2024

  DFSP # 424 - SSH Forensics: Understanding Secure Shell

  SSH is a protocol used to secure remote access to systems, making it a cornerstone in safeguarding sensitive information and ensuring secure communications. In this podcast, we will delve into the basics of SSH, its key concepts and other useful...

  
• 03.26.2024

  DFSP # 423 - Guiding Lights: Cyber Investigations Investigation Lifecycle

  This week I'm discussing a fundamental aspect of cybersecurity: incident response preparation. Effective incident response is paramount, and preparation is the key to success. This preparation includes comprehensive documentation, training, having the right tools and resources in place, and developing...

  
• 03.19.2024

  DFSP # 422 - EVTX Express: Cracking into Windows Logs Like a Pro

  Today I'm talking Windows forensics, focusing on Windows event logs. These logs are very valuable for fast triage, often readily available in your organization's SIEM. But have you ever wondered about the processes enabling this quick access? Not only are...

  
• 03.12.2024

  DFSP # 421 - Memory Lane: Fileless Linux Attacks Unraveled

  In this podcast episode, we talk about Linux's `memfd` – a virtual file system allowing the creation of anonymous memory areas for shared memory or temporary data storage. Threat actors exploit `memfd` for fileless malware attacks, as its memory areas...

  
• 03.05.2024

  DFSP # 420 - Failing, Stopping and Crashing

  This week we explore into the world of Windows service event codes and their role in forensic investigations. Windows services are background processes crucial for system functionality, running independently of user interaction- making them ideal. Target were exploitation. Join me...

  
• 02.27.2024

  DFSP # 419 - What the Flux

  This week, we're delving into the realm of fast flux, a cunning technique employed by attackers to cloak their true, malicious domains. Its effectiveness is the reason behind its widespread use, making it crucial for analysts to grasp its nuances...

  
• 02.20.2024

  DFSP # 418 - Core Insights: Navigating MFT in Forensics

  In this week's exploration, I'm delving into the intricate realm of the Master File Table (MFT), a pivotal forensic artifact in Windows investigations. The MFT provides a valuable gateway to decode evidence across various scenarios. Join me in this episode...

  
• 02.13.2024

  DFSP # 417 - Unlocking Linux Secrets

  This week I delve into the intriguing domain of Linux malware triage. The Linux platform presents forensic analysts with a unique opportunity to excel in performing malware triage effortlessly. The beauty of it lies in the fact that you don't...

  
• 02.06.2024

  DFSP # 416 - Persistence Mechanisms on Windows

  This week I’m going to talk about New Service Installation details recorded in Windows event logs. These have a number of advantages for your triage methodology and I will have all the details coming up. 

  
• 01.30.2024

  DFSP # 415 - Dealing with Third-Party Incidents

  Organizations leverage third-party services more and more for business advantages. For the security professional, this means the organizational data you're charged with protecting is under the control of a third-party in some way shape or form. In this episode, I...

  
• 01.23.2024

  DFSP # 414 - CRON Forensics

  Cron become important and Linux forensics when you’re talking about persistence. Think scheduled tasks if you want a Windows equivalent. The artifact is not that difficult to analyze once you understand the elements to focus on and it is typically...

  
• 01.16.2024

  DFSP # 413 - Ransomware Initial Response

  Ransomware cases can be particularly challenging, especially during the initial response. They tend to be fast-paced and require the responder to simultaneously prioritize a number of tasks. Each of these tasks can have critical impact upon the outcome of the...

  
• 01.09.2024

  DFSP # 412 - Conhost Forensics

  Conhost, or the Console Application Host, often comes up during investigations. Understanding what it is, the evidence may contain and how to extract that information becomes important...

  
• 01.02.2024

  DFSP # 411 - NTLM Credential Validation

  This week I'm talking about detecting evidence of lateral movement on Window systems using NTLM credential validation events. Much like the episode I did on Kerberos, NTLM events offer the same advantage of being concentrated on domain controllers, which allows...

  
• 12.26.2023

  DFSP # 410 - Linux Temp Directories

  Temporary directories play a significant role in computer forensic investigations as they can potentially contain valuable digital evidence. When conducting a computer forensic investigation, these temporary directories can provide insights into user activities, application usage, and potentially malicious behavior...

  
• 12.19.2023

  DFSP # 409 - Regsvcs and Regasm Abuse

  This week I’m talking about Regsvcs /Regasm exploitation, which is a Windows tactic attackers use to evade defense mechanisms and execute code. Specifically, this technique can be used to bypass process whitelisting and digital certificate validation. I'll break down some...

  
• 12.12.2023

  DFSP # 408 - Nesting

  This week I’m talking about Nested Groups and the risk they pose for security. Built-in to the functionality of Active Directory is the ability to attach a group to another group. While this has advantages for account administration across an...

  
• 12.05.2023

  DFSP # 407 - More About Lateral Movement and Kerberos

  This week it's more about lateral movement and kerberos events.

  
• 11.28.2023

  DFSP # 406 - All the BIN Directories

  In a typical Linux "bin" directory, you can find various types of executable files and scripts that are used to perform different tasks. The confusing part is that there are a number of different BIN directories throughout the file system....

  
• 11.21.2023

  DFSP # 405 - Werfault Attacks

  Werfault is in interesting artifact in that there is not a lot of documentation on it but yet it may affect an investigation in different ways.  Its appearance in logs sometimes adds a bit of confusion to an investigation because...

  
• 11.14.2023

  DFSP # 404 - Certutil Attacks

  Certutil, a powerful command-line utility, possesses the potential for misuse by malicious actors to establish illicit network connections. Therefore, it is crucial to familiarize oneself with its legitimate applications and recognize common indicators of misuse. In this episode, we will...

  
• 11.07.2023

  DFSP # 403 - Lateral Movement Kerberos Auth Events

  This week I'm going to cover an important Windows event that provides valuable information about authentication attempts and potential security breaches. The event may be used to identify compromised accounts, identify brute, force, attacks, or password spraying attacks. It may...

  
• 10.31.2023

  DFSP # 402 - Linux Root Directory Files for DFIR

  In Linux and Unix-based operating systems, the "root" account is the superuser or administrator account with the highest level of privileges. It has complete control over the system and can perform any action, including modifying system files, installing software, and...

  
• 10.24.2023

  DFSP # 401 - INF Fetch Execute

  This week we are taking a bit of a deep dive into an advanced attack technique to accomplish remote execution called “fetch and execute.” While there are different methods to accomplish the sort of thing what I am going to...

  
• 10.17.2023

  DFSP # 400 - CMSTP

  This week I am going to focus on a specific remote execution technique that you may see in the wild. Remote execution is important for incident response investigations but also for file use and knowledge investigations, particularly those that conducted...

  
• 10.10.2023

  DFSP # 399 - Lateral Movement Failed Logon Events

  Finding and analyzing failed logons sometimes is just as important as finding suspicious, actual logon activity. Like anything, context is important. Old logon records offer an opportunity to identify not only suspicious activity, but perhaps attempted activity by an attacker....

  
• 10.03.2023

  DFSP # 398 - OODA & JOHARI

  This week I will discuss the use of the OODA loop and JOHARI window in security incident response investigations. These two frameworks are designed to help organizations quickly and effectively respond to security incidents, and can be used in combination...

  
• 09.26.2023

  DFSP # 397 - Linux Home Directory Files for DFIR

  This week I'm talking about the linux file system from the point of view of a forensic analyst. In general, it's a good idea to have a solid working knowledge of the linux file system so you understand what directories...

  
• 09.19.2023

  DFSP # 396 - URL Leak

  This week I will talk about investigating data spill cases involving exposed URLs. This is a typical privacy investigation many incident response teams handle and I thought it would be useful to go over some standard guidelines for handling such...

  
• 09.12.2023

  DFSP # 395 - Lateral Movement and Admin Logons

  This week is on lateral movement detection techniques. Inspecting Domain Admin account logons is a key component to lateral movement triage. Admin accounts are sought after by attackers for their elevated privileges. Evidence is often left behind both on the...

  
• 09.05.2023

  DFSP # 394 - Functional Documentation

  This week I want to talk about the value of having functional documentation for your organization, or, at least for your team. Functional documentation means you have thoughtful and up-to-date incident run books, and play books that provide utility and...

  
• 08.29.2023

  DFSP # 393 - Linux Subsystems for Windows

  The linux subsystem for windows, create both opportunity and challenges for forensic analysts. It makes Windows an excellent platform for multi platform forensic analysis tasks, allowing it to take it vantage of the many many Linux tools available. The challenges...

  
• 08.22.2023

  DFSP # 392 - Simulation Training

  This week I'm going to talk about tabletop exercises as part of a security training program. I feel that there is too much focus on technical skill training and not enough focus on actual incident management training in the industry....

  
• 08.15.2023

  DFSP # 391 - Investigation Lifecycle

  This week I'm talking about The NIST (National Institute of Standards and Technology) investigation lifecycle. The NIST investigation lifecycle encompasses a series of well-defined steps, starting from problem identification and scoping, through data collection and analysis, to the formulation of...

  
• 08.08.2023

  DFSP # 390 - SSH Triage

  This week I'm talking about linux forensic triage strategy. In particular, I'm covering SSH. SSH traffic comes up in many different types of investigations. For that reason, it is a common and standard artifact every examiner should be familiar with....

  
• 08.01.2023

  DFSP # 389 - $Usnrl

  The USN Journal, also known as the Update Sequence Number Journal, is a feature of the Windows operating system that serves as a record of changes made to files and directories on a disk volume. It provides valuable information and...

  
• 07.25.2023

  DFSP # 388 - Web 3.0 Talk with SUMURI

  This week Jason Roslewicz from SUMURI returns for some web 3.0 and virtual reality talk.

  
• 07.18.2023

  DFSP # 387 - Network Share Modifications

  This week I talk about adding, modifying, and removing network shares through the lens of detecting lateral movement.