Research notes

Responder: The Ultimate Tool for Samba Server Hijack and NetNTLM Hash Theft In the vast arsenal of cybersecurity tools, Responder stands out…

In previous report on Cobalt Strike focused on the most frequently used capabilities that observed. In this report, we will focus on the…

This post discuss some Digital Forensics and Incident Response (DFIR) techniques you can leverage when you encounter an environment without Windows event…

A good detection technique to spot Remote Desktop Connections that are exposed to the internet is to scan RDP event logs for…

Generic Windows Artifacts Windows 10 Notifications In the path \Users\<username>\AppData\Local\Microsoft\Windows\Notifications you can find the database appdb.dat (before Windows anniversary) or wpndatabase.db (after…

Introduction This post is inspired by all the hard working DFIR, and more broadly security professionals, who have put in the hard…