https://dfir.au/areas/detection-engineering/Recent content in Detection Engineering on Matthew Green | DFIR, Threat Intelligence & ResearchHugoen-USWed, 12 Jan 2022 00:00:00 +0000https://dfir.au/posts/2022/wmi-eventing/Wed, 12 Jan 2022 00:00:00 +0000https://dfir.au/posts/2022/wmi-eventing/Find WMI event consumers that common collection methods miss, including persistence in custom namespaces. Covers collection and detection with Velociraptor.https://dfir.au/posts/2019/binaryrename2/Wed, 29 May 2019 00:00:00 +0000https://dfir.au/posts/2019/binaryrename2/Compare YARA and PowerShell approaches to finding renamed executables on disk, with code examples and detection limitations.https://dfir.au/posts/2019/binaryrename/Sun, 12 May 2019 00:00:00 +0000https://dfir.au/posts/2019/binaryrename/Detect renamed Windows binaries by comparing executable metadata with process names and paths. Includes a proof of concept and its limitations.https://dfir.au/posts/2018/downloadcradle/Mon, 02 Apr 2018 00:00:00 +0000https://dfir.au/posts/2018/downloadcradle/Compare PowerShell download cradles and their network and endpoint traces, with test scripts to help assess detection coverage.https://dfir.au/posts/2017/wmi_eventing/Mon, 03 Apr 2017 00:00:00 +0000https://dfir.au/posts/2017/wmi_eventing/Use WMI event subscriptions to monitor processes and trigger file collection on older Windows systems with visibility gaps.