This week I cover malware on Linux file systems for new examiners.

This week is a guide to understanding SVCHOST from a DFIR point of view. It is one of the most abused Windows processes, and having a firm working knowledge for investigations is essential.

This week is a Windows artifact breakdown on a common source of evidence.

This week I cover the Linux file system for new examiners.

This week I breakdown the elements within a standard CVSS report for fast triage application.

This week I talk about how to triage Windows events for network connection activity.

This week I talk about how to approach investigations involving remote desktop connections.

This week I talk about Windows core processes from a DFIR point of view.

This week I talk about Powershell attack IOCs.

This week I talk about how to triage Windows events for network connection activity.