Date Author Title
2023-11-27Guy BruneauDecoding the Patterns: Analyzing DShield Honeypot Activity [Guest Diary]
2023-08-12Guy BruneauDShield Sensor Monitoring with a Docker ELK Stack [Guest Diary]
2023-07-23Guy BruneauInstall & Configure Filebeat on Raspberry Pi ARM64 to Parse DShield Sensor Logs
2023-06-11Guy BruneauDShield Honeypot Activity for May 2023
2023-01-26Tom WebbLive Linux IR with UAC
2023-01-21Guy BruneauDShield Sensor JSON Log to Elasticsearch
2022-08-22Xavier Mertens32 or 64 bits Malware?
2022-04-19Johannes UllrichResetting Linux Passwords with U-Boot Bootloaders
2021-12-04Guy BruneauA Review of Year 2021
2021-11-04Tom WebbXmount for Disk Images
2021-09-11Guy BruneauShipping to Elasticsearch Microsoft DNS Logs
2021-06-18Daniel WesemannNetwork Forensics on Azure VMs (Part #2)
2021-06-17Daniel Wesemann Network Forensics on Azure VMs (Part #1)
2021-05-14Xavier Mertens"Open" Access to Industrial Systems Interface is Also Far From Zero
2021-05-12Jan KoprivaNumber of industrial control systems on the internet is lower then in 2020...but still far from zero
2021-02-25Daniel WesemannForensicating Azure VMs
2021-02-13Guy BruneauUsing Logstash to Parse IPtables Firewall Logs
2021-01-30Guy BruneauPacketSifter as Network Parsing and Telemetry Tool
2020-12-19Guy BruneauSecure Communication using TLS in Elasticsearch
2020-12-16Daniel WesemannDNS Logs in Public Clouds
2020-12-08Johannes UllrichDecember 2020 Microsoft Patch Tuesday: Exchange, Sharepoint, Dynamics and DNS Spoofing
2020-08-01Jan KoprivaWhat pages do bad bots look for?
2020-05-06Xavier MertensKeeping an Eye on Malicious Files Life Time
2020-03-02Jan KoprivaSecure vs. cleartext protocols - couple of interesting stats
2019-10-25Rob VandenBrinkMore on DNS Archeology (with PowerShell)
2019-08-21Russ McReeKAPE: Kroll Artifact Parser and Extractor
2019-07-11Johannes UllrichRemembering Mike Assante
2018-11-30Remco VerhoefCoinMiners searching for hosts
2018-07-29Guy BruneauUsing RITA for Threat Analysis
2018-02-25Guy BruneauBlackhole Advertising Sites with Pi-hole
2018-01-26Xavier MertensInvestigating Microsoft BITS Activity
2017-10-02Xavier MertensInvestigating Security Incidents with Passive DNS
2017-09-24Jim ClausingForensic use of mount --bind
2017-09-19Jim ClausingNew tool: mac-robber.py
2017-07-09Russ McReeAdversary hunting with SOF-ELK
2017-05-23Rob VandenBrinkWhat did we Learn from WannaCry? - Oh Wait, We Already Knew That!
2017-05-16Russ McReeWannaCry? Do your own data analysis.
2017-01-12Mark BaggettSystem Resource Utilization Monitor
2016-10-31Russ McReeSEC505 DFIR capture script: snapshot.ps1
2016-10-19Xavier MertensSpam Delivered via .ICS Files
2016-08-11Pasquale StirparoLooking for the insider: Forensic Artifacts on iOS Messaging App
2016-07-10Kevin ListonLessons Learned from Industrial Control Systems
2016-05-22Pasquale StirparoThe strange case of WinZip MRU Registry key
2016-03-28Xavier MertensImproving Bash Forensics Capabilities
2016-03-11Jim ClausingForensicating Docker, Part 1
2016-02-18Xavier MertensHunting for Executable Code in Windows Environments
2016-01-06Russ McReetoolsmith #112: Red vs Blue - PowerSploit vs PowerForensics
2015-12-04Tom WebbAutomating Phishing Analysis using BRO
2015-08-29Tom WebbAutomating Metrics using RTIR REST API
2015-04-24Basil Alawi S.TaherFileless Malware
2015-04-17Didier StevensMemory Forensics Of Network Devices
2015-03-18Daniel WesemannNew SANS memory forensics poster
2015-02-03Johannes UllrichAnother Network Forensic Tool for the Toolbox - Dshell
2014-08-10Basil Alawi S.TaherIncident Response with Triage-ir
2014-06-22Russ McReeOfficeMalScanner helps identify the source of a compromise
2014-06-03Basil Alawi S.TaherAn Introduction to RSA Netwitness Investigator
2014-05-18Russ McReesed and awk will always rock
2014-03-11Basil Alawi S.TaherIntroduction to Memory Analysis with Mandiant Redline
2014-03-07Tom WebbLinux Memory Dump with Rekall
2014-02-09Basil Alawi S.TaherMandiant Highlighter 2
2014-01-10Basil Alawi S.TaherWindows Autorun-3
2013-12-12Basil Alawi S.TaherAcquiring Memory Images with Dumpit
2013-11-21Mark Baggett"In the end it is all PEEKS and POKES."
2013-11-20Mark BaggettSearching live memory on a running machine with winpmem
2013-11-19Mark BaggettWinpmem - Mild mannered memory aquisition tool??
2013-08-26Alex StanfordStop, Drop and File Carve
2013-08-14Johannes UllrichImaging LUKS Encrypted Drives
2013-07-12Rob VandenBrinkHmm - where did I save those files?
2013-05-23Adrien de BeaupreMoVP II
2013-04-25Adam SwangerSANS 2013 Forensics Survey - https://www.surveymonkey.com/s/2013SANSForensicsSurvey
2013-02-20Manuel Humberto Santander PelaezSANS SCADA Summit at Orlando - Bigger problems and so far from getting them solved
2012-11-02Daniel WesemannThe shortcomings of anti-virus software
2012-09-14Lenny ZeltserAnalyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-07-16Jim ClausingAn analysis of the Yahoo! passwords
2012-06-04Lenny ZeltserDecoding Common XOR Obfuscation in Malicious Code
2011-09-29Daniel WesemannThe SSD dilemma
2011-08-05Johannes UllrichForensics: SIFT Kit 2.1 now available for download http://computer-forensics.sans.org/community/downloads
2011-03-01Daniel WesemannAV software and "sharing samples"
2010-11-26Mark HofmanUsing password cracking as metric/indicator for the organisation's security posture
2010-11-17Guy BruneauReference on Open Source Digital Forensics
2010-05-22Rick WannerSANS 2010 Digital Forensics Summit - APT Based Forensic Challenge
2010-05-21Rick Wanner2010 Digital Forensics and Incident Response Summit
2010-04-30Kevin ListonThe Importance of Small Files
2010-04-11Marcus SachsNetwork and process forensics toolset
2010-03-26Daniel WesemannSIFT2.0 SANS Investigative Forensics Toolkit released
2009-12-14Adrien de BeaupreAnti-forensics, COFEE vs. DECAF
2009-11-25Jim ClausingUpdates to my GREM Gold scripts and a new script
2009-10-20Raul SilesWASC 2008 Statistics
2009-08-18Daniel WesemannForensics: Mounting partitions from full-disk 'dd' images
2009-08-13Jim ClausingNew and updated cheat sheets
2009-07-02Daniel WesemannGetting the EXE out of the RTF
2009-02-02Stephen HallHow do you audit your production code?
2009-01-02Rick WannerTools on my Christmas list.
2008-11-17Marcus SachsNew Tool: NetWitness Investigator
2008-09-08Raul SilesQuick Analysis of the 2007 Web Application Security Statistics
2008-08-17Kevin ListonVolatility 1.3 Released
2008-08-15Jim ClausingOMFW 2008 reflections
2008-06-18Marcus SachsOlympics Part II