SIEM Alert: Investigating Malware Infiltration and Discord Forensics
Our SIEM alert revealed malware blocked by AV on an employee’s machine. The incident response team is investigating the attack’s entry point and…
Category: Network security
Bypassing Host Security Detection in Offensive and Defensive Confrontations: A New Data Recovery Trick
In offensive and defensive confrontations, deploying shellcode directly on the disk can bypass host security detection, as it is not recognized as a…
Evaluating Linux Data Recovery Tools: A Comprehensive Analysis of R-Studio, TestDisk, and More
We evaluated Linux data recovery tools on a severely damaged ext4 system. R-Studio performed best, recovering more files than other tools, making it…
Enhance Cybersecurity with Real Intelligence Threat Analytics (RITA) and Zeek for Advanced Threat Detection
RITA (Real Intelligence Threat Analytics) is an open-source tool for cybersecurity analysis, detecting threats by analyzing network traffic data and providing real-time alerts.
Maximize Security and Observability with Splunk Data Platform: Installation and Configuration Guide
Splunk data platform supports enterprise observability, security, and custom applications. Install Splunk on Linux, set up the Universal Forwarder on Windows, and configure…
Effective Methods to Prevent SSH Brute Force Attacks on Linux Servers
This post explains methods to prevent SSH brute force attacks, including configuring Fail2Ban and PAM to limit login attempts and enhance Linux server…
Comprehensive Guide to Using Registry Editor for Windows Forensics and Security Analysis
The Windows Registry stores OS configuration settings. Use Win + R and type regedit to open the Registry Editor. It helps in forensic…
Understanding Shimcache: A Forensic Tool for Tracking Executed Applications on Windows Systems
Shimcache, also known as AppCompatCache, records information about executed files on Windows systems, including filenames, paths, and timestamps. It aids forensic investigations.
Mastering Windows Registry Forensics: A Guide to Using FTK Imager and Registry Explorer
The article discusses forensic practices with the Windows Registry, emphasizing creating system images and using tools like FTK Imager and Registry Explorer for…
Understanding the SAM Hive: User Accounts, Control Sets, and Forensic Analysis
The SAM hive stores user accounts, groups, login info, and password policies. It also holds deleted user info. SYSTEM and SOFTWARE hives store…
Load More