This week is the third part of the Network-Fast-Triage mini-series. In this installation I cover triage techniques for Windows event logs that record network port-binding.

This week is the second part of the Network-Fast-Triage mini-series. In this installation I cover triage techniques for Windows event logs that record network connections.

This week I cover triage techniques for werfault.exe. The process does not have the best documentation which makes it a challenge to triage.

This week is the first part of the Network-Fast-Triage mini-series. The first installation is the network investigation primer.

This week I go over a method to detect fileless malware on Linux systems.

This week I talk utilizing the ExploitDB for DFIR investigations. Searchsploit is a command line search tool for Exploit-DB that allows you the power to perform detailed off-line searches through your locally checked-out copy of the repository. This capability is particularly useful for security assessments on segregated or air-gapped networks without Internet access.

This week is the last part of the Persistence-Fast-Triage mini-series. The final installation covers Windows startup locations.

This week I talk about the IR Investigation Lifecycle, or, the elements included within the incident handling process to ensure a complete investigation.

This week I talk about the use of RUNDLL32 to exploit information files (.INF) to "fetch and execute" malware.