Research notes

Responder: The Ultimate Tool for Samba Server Hijack and NetNTLM Hash Theft In the vast arsenal of cybersecurity tools, Responder stands out…

This blog post will walk you through the steps of remotely capturing traffic from a domain controller and then analyzing it locally.…

Wireshark RDP resources Looking for a way to capture and inspect RDP traffic in Wireshark? You’ve come to the right place! SSLKEYLOGFILE…

In previous report on Cobalt Strike focused on the most frequently used capabilities that observed. In this report, we will focus on the…

Before starting the analysis, I’m going to use the following environment and tools: Furthermore, it’s always recommended to install Oletools # python…

Learning Objectives Understand the advantages and goals of PCAP Analysis How to pivot into and away from PCAP Analysis (how to use…

This post discuss some Digital Forensics and Incident Response (DFIR) techniques you can leverage when you encounter an environment without Windows event…

A good detection technique to spot Remote Desktop Connections that are exposed to the internet is to scan RDP event logs for…

Generic Windows Artifacts Windows 10 Notifications In the path \Users\<username>\AppData\Local\Microsoft\Windows\Notifications you can find the database appdb.dat (before Windows anniversary) or wpndatabase.db (after…