Triage
FlowCarp Identifies Protocols
I am thrilled to announce the release of a brand new tool called FlowCarp! FlowCarp is a simple command line tool that performs a very complicated task. It identifies the application layer ...
CrowdStrike Charlotte AI Detection Triage Aims to Boost SOC Efficiency
CrowdStrike launched Charlotte AI Detection Triage, a platform based on agentic AI, which automates detection triage — the aim is to reduce workloads for security operations centers (SOCs) ...
EvilExtractor Network Forensics
I analyzed a PCAP file from a sandbox execution of the Evil Extractor stealer malware earlier today. This stealer collects credentials and files of interest from the victim's computer and exfiltrates them ...
Hunting injected processes by the modules they keep
A relatively recent post showed how Metasploit's Meterpreter module made some noise on endpoints when the migrate command was used to move the agent code into a legitimate process, spoolsv.exe in our ...
Analyzing an Instance of Meterpreter’s Shellcode
In my previous post on detecting and investigating Meterpreter's Migrate functionality, I went down a rabbit hole on the initial PowerShell attack spawned by and Excel macro. In that payload was a ...
The DFIR Hierarchy of Needs & Critical Security Controls
As you weigh how best to improve your organization's digital forensics and incident response (DFIR) capabilities heading into 2017, consider Matt Swann's Incident Response Hierarchy of Needs. Likely, at some point in ...
