Jumplists are crucial in investigations, providing data on user activities like file access and modification. Introduced in Windows 7, they offer insights even…
SRUM is a forensic goldmine, tracking program execution, power, and network activity on Windows systems. It stores data in SRUDB.dat, useful for investigating…
RDP session images are cached for faster retrieval, enhancing user experience. Forensics can analyze these caches to uncover activities. Tools like bmc-tools and…
The Windows Recycle Bin is crucial in forensic investigations as it stores deleted items and their metadata. Tools like RBcmd can parse this…
The chapter discusses the complexities of Ransomware as a Service (RaaS) and various tactics, techniques, and procedures (TTPs) used by attackers.
I visited Russia and explored advanced cyber security books in Moscow. Impressed by Russian hacking techniques, I translated them using human effort and…
Enabling advanced Windows event logs such as process creation, DNS queries, file monitoring, and network connections can enhance threat hunting during incident response.
To achieve efficient data synchronization through the GFW using rsync, which lacks tls support, trojan and proxychains can disguise tls traffic, ensuring secure…
Crontab is a Linux scheduling tool managed in Ansible via the cron module. It handles tasks, environment variables, and validates crontab entries efficiently.
For VPN collaboration, we chose Zerotier over frp+openvpn due to its built-in P2P hole punching. Setting up a Moon server with a public…