SANS Digital Forensics and Incident Response Blog: Category - Incident Response

Mass Triage Part 3: Processing Returned Files - At Jobs

Our story so far... Frank, working with Hermes, another security analyst, goes to work to review the tens of thousands of files retrieved by FRAC. They start off by reviewing the returned AT jobs. AT Job Used by Actors AT jobs are scheduled tasks created using the at.exe command. At jobs take the filename format … Continue reading Mass Triage Part 3: Processing Returned Files - At Jobs


Rapid Provisioning of a Malware Analysis Environment

The preparation of a malware analysis environment can often be a lengthy and repetitive process. I am not referring to setting up a virtual machine which contains all of your tools, but rather recognising that each sample you analyse may have very specific environmental requirements before it is willing to execute fully. For example, it … Continue reading Rapid Provisioning of a Malware Analysis Environment


Webcast Summary: New SANS Cheat Sheet: A Guide to Eric Zimmerman's Command Line Tools

Thank you for attending the SANS New Cheat Sheet: "A Guide to Eric Zimmerman's Command Line Tools" webcast. For webcast slides and recording visit:http://www.sans.org/u/raj To download the Cheat Sheet visit:http://digital-forensics.sans.org/u/rao To download Eric's Command line tools visit:https://ericzimmerman.github.io/ In this webinar, Eric covered several tools that can be used to show evidence of execution … Continue reading Webcast Summary: New SANS Cheat Sheet: A Guide to Eric Zimmerman's Command Line Tools


Forensic 4:cast Awards Nomination Closing Date and News

Blog originally posted by Lee Whitfield, March 12th, 2017: http://dfir.to/2nFvLP5 Award Nomination submission page: http://dfir.to/4CAST2017 Deadline for submissions: March 31, 2017 A number of people have asked me about the closing date for the nominations for the Forensic 4:cast Awards. Well here it is: March 31, 2017. I will be accepting nominations … Continue reading Forensic 4:cast Awards Nomination Closing Date and News


Ken Johnson DFIR Scholarship

Ken Johnson, husband of Jessica Towle Johnson, and father of two beautiful young children, Savannah and Brady, was tragically taken from this life on April 4, 2016 at the age of 38. Ken was an amazing husband and father. He was married to his best friend on February 19, 2000. His love for his … Continue reading Ken Johnson DFIR Scholarship