Digital Forensic Survival Podcast

Amanda Berlin of Blumira speaks on malicious Powershell attacks and defense techniques.

This week SUMURI's Steve Whalen (a.k.a. 'MacBoy') talks Mac forensics.

This week I’m talking about Nested Groups and the risk they pose for security. Built-in to the functionality of Active Directory is the ability to attach a group to another group. While this has advantages for account administration across an organization, it also offers attackers opportunity if certain precautions are not taken. This week I’ll break down Nested Groups in DFIR terms, talk about ho...

This week is a case study where we look at an actual attack strategy and compared it against standard triage methods to see how well they hold up. The Turla group using ComRat malware is our case example, let’s see if standard triage techniques can save the day.

Matt Warner, Blumira CTO and Co-Founder, talks ransomware investigations.

This week is a continuation of the threats to cloud computing miniseries. We are stepping through the top 11 threats to cloud computing as identified by the Cloud Security alliance. When you are protecting cloud assets or investigating breaches of cloud assets, there is a lot to keep in mind. You must remember the standard security infrastructure, the new cloud infrastructure as well as any change...

This week is a case study that demonstrates how fundamental DFIR triage methods can detect advanced attacks. Examiners, especially newer examiners, should find confidence in the fact that standard triage techniques have such a powerful impact on security investigations.

This week Nato Riley from Blumira pays a visit to talk about the top threats to cloud computing.

This week we continue with the Windows fast triage series and talk about lateral movement evidence that may be found in admin shares event records.  Four different types of logs are covered, each containing different information for triage purposes.

This week SUMURI's Steve Whalen (a.k.a. 'MacBoy') and Dave Melvin talk about the latest in Mac training and certification. Learn the advantages of vendor neutral training and how to prioritize it in your own training regiment.

This week I wanted to take a break from Windows forensics and talk about Linux malware triage. The Linux platform offers forensic analysts the opportunity to do a very decent job performing malware triage. What I mean by this is that you do not need any special tools installed, all you essentially need is the knowledge of a handful of commands in the ability to make sense of the output. Armed with...

This week we’re going to take a look at how standard triage methodology can detect advanced attack techniques. Even as a newer examiners, if you learn the standard triage methods that I have covered in the fast triage series, you will find the skills provide ample opportunity to detect all sorts attack activity-even very advanced attack activity. This is because there are natural chokepoints in th...

This week is about preparing for Golden SAML attacks for both Incident Response and Threat Hunting.

This week is about theatrics in security and how to avoid the trap.

This week I revisit Windows Core Processes and the triage methods to apply to them.

This week I talk about vulnhub, a free resource to practice ethical hacking skills and sharpen your DFIR skills.

This week I revisit Windows Core Processes and the triage methods to apply to them.

This week is the fourth part of the Network-Fast-Triage mini-series. In this installation I cover triage techniques for Windows event logs that record blocked network activity.

This week is about supply chain security posture from a DFIR point-of-view.

This week I go over a method to detect kernel process masquerading on Linux systems.

This week I interview author Shawn Livermore about the myth of the "tech-genius."

This week is the second part of the Network-Fast-Triage mini-series. In this installation I cover triage techniques for Windows event logs that record network connections.

This week I cover triage techniques for werfault.exe. The process does not have the best documentation which makes it a challenge to triage.

This week I interview Haseeb Awan, CEO of EFANI, about the rise of SIM swapping attacks. Haseeb explains the attack, how attackers carry it out, and provides some mitigation strategies.

This week is the first part of the Network-Fast-Triage mini-series. The first installation is the network investigation primer.