Threat Level: green Handler on Duty: Russell Eubanks

SANS ISC Diaries by Keyword


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
DateAuthorTitle

MEMORY FORENSICS

2015-04-17Didier StevensMemory Forensics Of Network Devices
2013-05-23Adrien de BeaupreMoVP II
2009-01-02Rick WannerTools on my Christmas list.

MEMORY

2015-05-03/a>Russ McReeVolDiff, for memory image differential analysis
2015-04-24/a>Basil Alawi S.TaherFileless Malware
2015-04-17/a>Didier StevensMemory Forensics Of Network Devices
2014-08-27/a>Rob VandenBrinkOne More Day of Trolling in POS Memory
2014-03-11/a>Basil Alawi S.TaherIntroduction to Memory Analysis with Mandiant Redline
2014-03-07/a>Tom WebbLinux Memory Dump with Rekall
2013-12-12/a>Basil Alawi S.TaherAcquiring Memory Images with Dumpit
2013-05-23/a>Adrien de BeaupreMoVP II
2013-01-03/a>Bojan ZdrnjaMemory acquisition traps
2012-09-19/a>Kevin ListonVolatility: 2.2 is Coming Soon
2012-05-07/a>Guy BruneauiOS 5.1.1 Software Update for iPod, iPhone, iPad
2010-04-02/a>Guy BruneauFirefox 3.6.3 fix for CVE-2010-1121 http://www.mozilla.org/security/announce/2010/mfsa2010-25.html
2009-07-26/a>Jim ClausingNew Volatility plugins
2009-02-05/a>Rick WannerMandiant Memoryze review, Hilighter, other Mandiant tools!
2009-01-02/a>Rick WannerTools on my Christmas list.
2008-12-13/a>Jim ClausingFollowup from last shift and some research to do.
2008-11-22/a>G. N. WhitePicture Printing Kiosks & Flash Memory Devices
2008-11-17/a>Jim ClausingFinding stealth injected DLLs

FORENSICS

2015-04-24/a>Basil Alawi S.TaherFileless Malware
2015-04-17/a>Didier StevensMemory Forensics Of Network Devices
2015-03-18/a>Daniel WesemannNew SANS memory forensics poster
2015-02-03/a>Johannes UllrichAnother Network Forensic Tool for the Toolbox - Dshell
2014-08-10/a>Basil Alawi S.TaherIncident Response with Triage-ir
2014-06-22/a>Russ McReeOfficeMalScanner helps identify the source of a compromise
2014-06-03/a>Basil Alawi S.TaherAn Introduction to RSA Netwitness Investigator
2014-05-18/a>Russ McReesed and awk will always rock
2014-03-11/a>Basil Alawi S.TaherIntroduction to Memory Analysis with Mandiant Redline
2014-03-07/a>Tom WebbLinux Memory Dump with Rekall
2014-02-09/a>Basil Alawi S.TaherMandiant Highlighter 2
2014-01-10/a>Basil Alawi S.TaherWindows Autorun-3
2013-12-12/a>Basil Alawi S.TaherAcquiring Memory Images with Dumpit
2013-11-21/a>Mark Baggett"In the end it is all PEEKS and POKES."
2013-11-20/a>Mark BaggettSearching live memory on a running machine with winpmem
2013-11-19/a>Mark BaggettWinpmem - Mild mannered memory aquisition tool??
2013-08-26/a>Alex StanfordStop, Drop and File Carve
2013-08-14/a>Johannes UllrichImaging LUKS Encrypted Drives
2013-07-12/a>Rob VandenBrinkHmm - where did I save those files?
2013-05-23/a>Adrien de BeaupreMoVP II
2013-04-25/a>Adam SwangerSANS 2013 Forensics Survey - https://www.surveymonkey.com/s/2013SANSForensicsSurvey
2012-11-02/a>Daniel WesemannThe shortcomings of anti-virus software
2012-09-14/a>Lenny ZeltserAnalyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-06-04/a>Lenny ZeltserDecoding Common XOR Obfuscation in Malicious Code
2011-09-29/a>Daniel WesemannThe SSD dilemma
2011-08-05/a>Johannes UllrichForensics: SIFT Kit 2.1 now available for download http://computer-forensics.sans.org/community/downloads
2011-03-01/a>Daniel WesemannAV software and "sharing samples"
2010-11-17/a>Guy BruneauReference on Open Source Digital Forensics
2010-05-22/a>Rick WannerSANS 2010 Digital Forensics Summit - APT Based Forensic Challenge
2010-05-21/a>Rick Wanner2010 Digital Forensics and Incident Response Summit
2010-04-30/a>Kevin ListonThe Importance of Small Files
2010-04-11/a>Marcus SachsNetwork and process forensics toolset
2010-03-26/a>Daniel WesemannSIFT2.0 SANS Investigative Forensics Toolkit released
2009-12-14/a>Adrien de BeaupreAnti-forensics, COFEE vs. DECAF
2009-11-25/a>Jim ClausingUpdates to my GREM Gold scripts and a new script
2009-08-18/a>Daniel WesemannForensics: Mounting partitions from full-disk 'dd' images
2009-08-13/a>Jim ClausingNew and updated cheat sheets
2009-07-02/a>Daniel WesemannGetting the EXE out of the RTF
2009-02-02/a>Stephen HallHow do you audit your production code?
2009-01-02/a>Rick WannerTools on my Christmas list.
2008-11-17/a>Marcus SachsNew Tool: NetWitness Investigator
2008-08-17/a>Kevin ListonVolatility 1.3 Released
2008-08-15/a>Jim ClausingOMFW 2008 reflections