Date Author Title
2026-05-27Guy BruneauAnalysis of a Year of Files Uploaded to DShield Sensors
2026-05-06Guy BruneauAn Adaptive Cyber Analytics UI for Web Honeypot Logs [Guest Diary]
2026-01-07Guy BruneauAnalysis using Gephi with DShield Sensor Data
2025-04-02Guy BruneauExploring Statistical Measures to Predict URLs as Legitimate or Intrusive [Guest Diary]
2025-03-06Guy BruneauDShield Traffic Analysis using ELK
2024-10-17Guy BruneauScanning Activity from Subnet 15.184.0.0/16
2024-09-11Guy BruneauHygiene, Hygiene, Hygiene! [Guest Diary]
2024-08-16Jesse La Grew[Guest Diary] 7 minutes and 4 steps to a quick win: A write-up on custom tools
2024-05-28Guy BruneauIs that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2024-02-03Guy BruneauDShield Sensor Log Collection with Elasticsearch
2023-01-21Guy BruneauDShield Sensor JSON Log to Elasticsearch
2023-01-08Guy BruneauDShield Sensor JSON Log Analysis
2022-07-29Johannes UllrichPDF Analysis Intro and OpenActions Entries
2021-04-10Guy BruneauBuilding an IDS Sensor with Suricata & Zeek with Logs to ELK
2021-04-06Jan KoprivaMalspam with Lokibot vs. Outlook and RFCs
2021-01-30Guy BruneauPacketSifter as Network Parsing and Telemetry Tool
2020-10-01Daniel WesemannMaking sense of Azure AD (AAD) activity logs
2020-09-20Guy BruneauAnalysis of a Salesforce Phishing Emails
2020-06-01Jim ClausingStackstrings, type 2
2019-11-23Guy BruneauLocal Malware Analysis with Malice
2019-06-27Rob VandenBrinkFinding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell
2019-06-14Jim ClausingA few Ghidra tips for IDA users, part 4 - function call graphs
2019-04-17Jim ClausingA few Ghidra tips for IDA users, part 2 - strings and parameters
2019-04-08Jim ClausingA few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
2019-04-03Jim ClausingA few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters
2018-11-18Guy BruneauMultipurpose PCAP Analysis Tool
2018-10-21Pasquale StirparoBeyond good ol’ LaunchAgent - part 0
2018-08-31Jim ClausingQuickie: Using radare2 to disassemble shellcode
2018-06-01Remco VerhoefBinary analysis with Radare2
2017-09-29Lorna HutchesonGood Analysis = Understanding(tools + logs + normal)
2017-07-09Russ McReeAdversary hunting with SOF-ELK
2017-01-28Lorna HutchesonPacket Analysis - Where do you start?
2016-10-30Pasquale StirparoVolatility Bot: Automated Memory Analysis
2016-05-14Guy BruneauINetSim as a Basic Honeypot
2016-04-21Daniel WesemannDecoding Pseudo-Darkleech (Part #2)
2015-05-03Russ McReeVolDiff, for memory image differential analysis
2014-07-05Guy BruneauMalware Analysis with pedump
2014-04-21Daniel WesemannFinding the bleeders
2014-03-13Daniel WesemannWeb server logs containing RS=^ ?
2014-01-14Chris MohanSpamming and scanning botnets - is there something I can do to block them from my site?
2013-10-28Daniel WesemannExploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities
2013-06-18Russ McReeVolatility rules...any questions?
2013-05-11Lenny ZeltserExtracting Digital Signatures from Signed Malware
2013-03-09Guy BruneauIPv6 Focus Month: IPv6 Encapsulation - Protocol 41
2013-01-08Jim ClausingCuckoo 0.5 is out and the world didn't end
2012-12-02Guy BruneauCollecting Logs from Security Devices at Home
2012-09-19Kevin ListonVolatility: 2.2 is Coming Soon
2012-09-14Lenny ZeltserAnalyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-06-04Lenny ZeltserDecoding Common XOR Obfuscation in Malicious Code
2012-05-23Mark BaggettIP Fragmentation Attacks
2012-03-03Jim ClausingNew automated sandbox for Android malware
2012-02-07Jim ClausingBook Review: Practical Packet Analysis, 2nd ed
2011-05-20Guy BruneauSysinternals Updates, Analyzing Stuxnet Infection with Sysinternals Tools Part 3
2011-04-14Adrien de BeaupreSysinternals updates, a new blog post, and webcast
2011-02-01Lenny ZeltserThe Importance of HTTP Headers When Investigating Malicious Sites
2010-08-09Jim ClausingFree/inexpensive tools for monitoring systems/networks
2010-07-21Adrien de Beaupreautorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198)
2010-05-26Bojan ZdrnjaMalware modularization and AV detection evasion
2010-03-26Daniel WesemannGetting the EXE out of the RTF again
2010-01-14Bojan ZdrnjaPDF Babushka
2010-01-07Daniel WesemannStatic analysis of malicious PDFs
2010-01-07Daniel WesemannStatic analysis of malicous PDFs (Part #2)
2009-11-25Jim ClausingUpdates to my GREM Gold scripts and a new script
2009-09-25Lenny ZeltserCategories of Common Malware Traits
2009-07-26Jim ClausingNew Volatility plugins
2009-07-02Daniel WesemannGetting the EXE out of the RTF
2009-01-18Daniel Wesemann3322. org
2009-01-02Rick WannerTools on my Christmas list.
2008-12-13Jim ClausingFollowup from last shift and some research to do.
2008-11-17Jim ClausingFinding stealth injected DLLs
2008-07-07Pedro BuenoBad url classification