This week I Cover my all-time favorite Windows event, security event 4688: new process creation. If you do windows, incident, response, forensics, this is a must-know know artifact.

This week I talk about SVCHOST; how it fits into the Windows operating system, and how to think about it from a DFIR point of view.

This week I talk with Interview with Yugal Pathak about organizational forensic readiness.

This week I talk about the role and typical responsibilities DFIR professionals may be called up to take to assist with a zero-day response.

This week Jason Roslewicz from SUMURI returns to talk more about AI issues.

This week I break down the Windows System Resource Usage Monitor from a DFIR point of view.

This week I cover some malware detection methods for Linux.

This week I talk about different ways to approach windows process triage. There are so many processes, especially in enterprise environments, having a standard approach that is fast and effective is key for security incident response.

This week Jason Roslewicz from SUMURI shares his insights about the impact of artificial intelligence and provides advice for navigating through changing times. 

This week is a Windows artifact breakdown on a common source of evidence.