dfirfpi (@dfirfpi) profile picture

dfirfpi

@dfirfpi
 DFIR
blog.digital-forensics.it
Joined November 2012
  • Tweets2.4K
  • Following434
  • Followers1.2K
27Media
Photo by dfirfpi (@dfirfpi)Photo by dfirfpi (@dfirfpi)Photo by dfirfpi (@dfirfpi)Photo by dfirfpi (@dfirfpi)Photo by dfirfpi (@dfirfpi)Photo by dfirfpi (@dfirfpi)Photo by dfirfpi (@dfirfpi)Photo by dfirfpi (@dfirfpi)Photo by dfirfpi (@dfirfpi)Photo by dfirfpi (@dfirfpi)
Image from DogeDesigner (@cb_doge)
586
10,509
520
63,811
5,245,995
If you're starting out in security and find the breadth of stuff you "need to know" daunting, I want to give you some perspective: 1. The field has broadened - dramatically. The "baseline knowledge" grows every year. Anyone saying otherwise is lying or uninformed. 1/
30
238
40
1,262
258,427
The SANS #RansomwareSummit is open for registration! Join @rj_chap Live Online as we bring together #Cybersecurity professionals for in-depth talks focused on #Ransomware prevention, detection, response, and recovery. ✍️ Register For Free: sans.org/u/1p0B
Image from SANS Offensive Operations (@SANSOffensive)
1
4
1
7
5,190
Replying to @nas_bench
We target anything from C:\\Users as first path github.com/mgreen27/DetectRa…
1
3
12
821
Coming 🔜: #SANS 🇪🇸 Madrid, March 2023 🔦 #SANS In-Person Course Spotlight #FOR508: 🗣️@dfirfpi #FOR509: 🗣️Korstiaan Stam #ICS410: 🗣️ @meeas ➕ Search For More Courses: sans.org/u/1oiE #SANSTraining #EMEA #CyberSecurityTraining
Image from SANS Institute, EMEA (@SANSEMEA)
2
4
1,194
Replying to @mattiaep @domenicacrognal @sansforensics
Thanks to you and @dfirfpi for giving me this great opportunity ❤️ and thanks to all @_RealityNet (especially @KlodiaMaida) for all your support in these months ❤️
1
1
Congrats @SilviaSpallaro1 for your #GASF cert! Very well deserved, so proud of you! And thanks @domenicacrognal for teaching her :) #for585 @sansforensics
2
1
3
"write.exe" is just ShellExecute() to wordpad.exe. And ShellExecute() reads HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths before reading HKLM. Which means, you can use "write" to launch anything if you create "wordpad.exe" subkey. And it explains why I love Windows.🙃
9
197
8
807
Why you should never ever ever use pixelation as a redaction technique 🙈 github.com/bishopfox/unredac… #infosec #cybersecurity #dataprivacy
9
403
32
1,085
New #AADInternals version and related blog post (with multicolor arrows) out now! "Stealing and faking Azure AD device identities": o365blog.com/post/deviceiden… Credits to @gentilkiwi/#Mimikatz! #infosec #redteam #blueteam
Image from Dr. Nestori Syynimaa (@DrAzureAD)
Image from Dr. Nestori Syynimaa (@DrAzureAD)
13
176
9
387
Puzzled why a yara rule did or didn't match? Let me introduce yaradbg.dev, a web-based #yara #debugger! With #YaraDbg, you can see the: 1⃣ evaluation steps 2⃣ matched strings 3⃣ relationship among the rules
7
222
2
487
dfirfpi retweeted
mr.d0x (@mrd0x) profile picture
mr.d0x
@mrd0x11 Jan 2022
Procdump works against Defender with a simple rename. It quarantines the generated .dmp file but you have a few seconds to make a copy of it before it's removed. I've seen other security solutions that do this, try to copy the file quickly before it's removed.
Image from mr.d0x (@mrd0x)
Image from mr.d0x (@mrd0x)
8
86
1
272
📢 New Article Released! 📝 Domain Escalation - ShadowCoerce pentestlaboratories.com/2022… #pentestlaboratories #redteam #redteaming
1
52
3
85
dfirfpi retweeted
mr.d0x (@mrd0x) profile picture
mr.d0x
@mrd0x6 Jan 2022
Bypass Defender AV static detection: If you name a malicious file DumpStack.log Defender doesn't scan it.
Image from mr.d0x (@mrd0x)
36
975
99
3,169
I’ll just leave this here. @chadtilbury @Hexacorn @phillmoore github.com/jklepsercyber/def…
GitHub - jklepsercyber/defender-detectionhistory-parser: A parser of Windows Defender's Detection...

GitHub - jklepsercyber/defender-detectionhistory-parser: A parser of Windows Defender's Detection...

A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables. - jklepsercyber/defender-detectionhistory-parser

github.com
4
32
1
94
Don't you think #mimikatz 3 is more sexy with #kekeo inside? Still compatible with Windows XP, Without custom compiler this time (VS2019+ Community+) Without commercial ASN1 library
Image from 🥝🏳️‍🌈 Benjamin Delpy (@gentilkiwi)
10
126
2
396
SANS Live Online Europe February 2022 Volume 1 SEC504 w/ @bettersafetynet SEC488 w/ @RogerOfarril FOR508 w/ @dfirfpi SEC510 w/ @KennethGHartman FOR610 w/ @jclausing MGT514 w/ @_JoeSullivan Register 👉 sans.org/u/1k57
Image from SANS Institute, EMEA (@SANSEMEA)
4
4
SANS Live Online Europe January 2022 Volume 1 #FOR500 w/ @lee_whitfield #FOR508 w/ @dfirfpi #SEC660 w/ @mchllmmns #SEC530 w/ @Greg_Scheidel #MGT551 w/ @markaorlando Register 👉 sans.org/u/1jEP
Image from SANS Institute, EMEA (@SANSEMEA)
2
3
InjectionTracer v0.1 is OUT! A tool that aims to help you to 𝐢𝐝𝐞𝐧𝐭𝐢𝐟𝐲, 𝐝𝐞𝐛𝐮𝐠 𝐚𝐧𝐝 𝐝𝐮𝐦𝐩 the injected code. It supports most of the known process injection techniques. github.com/Maff1t/InjectionT…
1
4
16
Apple TV 4 with iOS 14.7. Jailbreak with @checkra1n Full file system with @ElcomSoft and @MagnetForensics Processing with @AlexisBrignoni iLEAPP and @iamevltwin APOLLO Nice :) – at Genoa, Liguria
Image from Mattia Epifani (@mattiaep)
Image from Mattia Epifani (@mattiaep)
Image from Mattia Epifani (@mattiaep)
Image from Mattia Epifani (@mattiaep)
1
13
1
45
Load more