SUM UAL - Investigating Server Access with User Access Logging
Learn what the SUM UAL database is and how it can help make or break DFIR analysis.
top of page
Search
- Apr 27
- 5 min
Linux Forensics - Collecting a Triage Image Using The UAC Tool
Learn how to take a triage image of a *nix based system using the UAC tool.
- Apr 16
- 6 min
Respond and Investigate a Compromised Google Workspace User
Learn how to respond and investigate a compromised Google Workspace user.
- Mar 28
- 4 min
Minimizing Malicious Script Execution
Learn some quick wins to minimize malicious script execution.
- Mar 11
- 5 min
Evidence of Program Existence - Amcache
Learn the mystery of the Amcache artifact and how to use it in your DFIR cases
- Jan 21
- 4 min
Evidence of Program Existence - Shimcache
Learn what Shimcache is, how to analyze it, and why it's misunderstood.
- Oct 9, 2023
- 5 min
Artifacts of Execution: Prefetch - Part One
Learn how to identify what programs were executed during an incident with the Prefetch artifact
- Sep 22, 2023
- 8 min
Cloud Incident Response: Investigating AWS Incidents
Learn the basics of AWS investigations and the logs that exist.
- Aug 18, 2023
- 5 min
Sysmon: When Visibility is Key
Learn why visibility is everything when responding to an incident.
- Aug 12, 2023
- 5 min
A LNK To The Past: Utilizing LNK Files For Your Investigations
We've all heard of "Link" or "LNK" files, right? You want a faster way to open your favorite game, document or application without need...
We love automation, right? Subscribe to get notifications from us.
Follow Us On:
bottom of page