Blog

Categories

How to Investigate Malware WMI Event Consumers 2025

Start Reading

What Is a Jump List?

Start Reading

What Is Jump List Cache?

Start Reading

Jump Lists Forensics 2025

Start Reading

Information Artifacts

Information Artifacts: Simplify DFIR Analysis

Start Reading

3.13 Adds MemProcFS and Extends the S3 and Recorded Future Sandbox Integrations

Start Reading

3.12 Adds Data Exfiltration Detection, USB Devices, and Easier Validation

Start Reading

DFIR Breakdown: Impacket Remote Execution Activity – smbexec

Start Reading

DFIR Next Steps: What to Do After You Find a Suspicious Use of Remote Monitoring and Management Tools

Start Reading

DFIR Breakdown: Impacket Remote Execution Activity – atexec

Start Reading

DFIR Next Steps: What To Do After You Find a Suspicious Use Of curl.exe

Start Reading

DFIR Next Steps: What To Do After You Find a Suspicious Use Of certutil.exe

Start Reading