https://dfir.au/areas/dfir/Recent content in DFIR on Matthew Green | DFIR, Threat Intelligence & ResearchHugoen-USFri, 01 Nov 2024 00:00:00 +0000https://dfir.au/posts/2024/finding_the_lnk/Fri, 01 Nov 2024 00:00:00 +0000https://dfir.au/posts/2024/finding_the_lnk/Advanced LNK analysis with Velociraptor, covering shortcut structures, suspicious fields, and useful clustering points for DFIR and CTI workflows.https://dfir.au/posts/2020/ipsec/Thu, 23 Jul 2020 00:00:00 +0000https://dfir.au/posts/2020/ipsec/Build and deploy Windows IPsec policies for endpoint quarantine through Velociraptor, with containment requirements and policy removal considerations.https://dfir.au/posts/2019/local_liveresponse_with_vr/Sun, 08 Dec 2019 00:00:00 +0000https://dfir.au/posts/2019/local_liveresponse_with_vr/A historical walkthrough of bundling Velociraptor with WinPMem and Autoruns for local triage. This approach was superseded by the GUI collector builder.https://dfir.au/posts/2019/liveresponse_with_vr/Sun, 10 Nov 2019 00:00:00 +0000https://dfir.au/posts/2019/liveresponse_with_vr/A historical walkthrough of automating Velociraptor collections and post-processing through its API. The examples predate the current API.https://dfir.au/posts/2019/o365_hiddenrules/Sun, 09 Jun 2019 00:00:00 +0000https://dfir.au/posts/2019/o365_hiddenrules/Examine how Office 365 inbox rules can be hidden, how rule properties are modified, and methods for detecting the changes.https://dfir.au/posts/2019/invoke-liveresponse_builder/Sun, 07 Apr 2019 00:00:00 +0000https://dfir.au/posts/2019/invoke-liveresponse_builder/Build modular live response scripts with Invoke-LiveResponse, including custom collection logic and support for legacy PowerShell.https://dfir.au/posts/2018/sharing_my_bits/Sun, 18 Feb 2018 00:00:00 +0000https://dfir.au/posts/2018/sharing_my_bits/Investigate Microsoft BITS job artefacts, collection methods and event logs to identify suspicious transfers and persistence.https://dfir.au/posts/2018/invoke-liveresponse/Sun, 14 Jan 2018 00:00:00 +0000https://dfir.au/posts/2018/invoke-liveresponse/Collect live response data and raw files over WinRM with Invoke-LiveResponse and PowerForensics. Covers setup, collection modes and forensic footprint.https://dfir.au/posts/2017/powershell_remoting_ir/Thu, 12 Jan 2017 12:00:00 +1000https://dfir.au/posts/2017/powershell_remoting_ir/Use PowerShell remoting and WinRM for incident response, with setup examples, collection options and operational considerations.