Threat Hunting on Matthew Green | DFIR, Threat Intelligence & Research

Threat Hunting on Matthew Green | DFIR, Threat Intelligence & Researchhttps://dfir.au/areas/threat-hunting/Recent content in Threat Hunting on Matthew Green | DFIR, Threat Intelligence & ResearchHugoen-USMon, 01 Dec 2025 00:00:00 +0000CLRaptor: Hunting reflected assemblies with Velociraptorhttps://dfir.au/posts/2025/clraptor_hunting_for_assemblies/Mon, 01 Dec 2025 00:00:00 +0000https://dfir.au/posts/2025/clraptor_hunting_for_assemblies/Hunt reflected .NET assemblies at scale with Velociraptor, detect CLR visibility gaps, and dump suspicious in-memory assemblies for analysis.How To Hunt For UEFI Malwarehttps://dfir.au/posts/2024/uefi/Thu, 29 Feb 2024 00:00:00 +0000https://dfir.au/posts/2024/uefi/UEFI malware hunting with Velociraptor, including firmware visibility, collection approaches, and artifacts for field investigation.Cobalt Strike Payload Discovery And Data Manipulation In VQLhttps://dfir.au/posts/2021/cobaltstrike_vql/Tue, 09 Nov 2021 00:00:00 +0000https://dfir.au/posts/2021/cobaltstrike_vql/Discover encoded Cobalt Strike payloads in MSBuild task files, collect them with Velociraptor and use VQL to decode payloads and extract indicators.