Incident Response Process Whitepaper

Incident Response Process

Handling Cybersecurity Incidents according to NIST SP-61 According to ISO/IEC 27035:2011 on Information security incident management, an information security incident...

KNOWLEDGE CENTER

Cybersecurity exercises International Standard ISO 22398 Whitepaper

Cybersecurity Exercises Whitepaper

Conducting Cybersecurity Exercises According to International Standard ISO 22398 Exercises and simulation activities have been around for decades, if not...

For Developers and Office Workers Guide to Hardening Windows 10 Technical Guide

Guide to Hardening Windows 10

Introduction Windows 10 is the most widely used desktop operating system in enterprise environment. It features extensive security policies, allowing...

Case Study phishing ryuk ryuk ransomware Ryuk Ransomware In The Healthcare Sector zbot

The Assassin Squad: Zbot and RYUK

Overview During recent months, there have been large outbreaks of the Ryuk ransomware. Armed with upgrades and modifications in comparison...

Case Study exploitation of vulnerable network devices REvil Sodinokibi Ransomware REvil/Sodinokibi Ransomware group

REvil Sodinokibi Ransomware

Overview During a recent client engagement, the LIFARS DFIR team encountered the REvil/Sodinokibi Ransomware group. The typical attack vector chosen...

System Resource Usage Monitor (SRUM) Technical Guide Windows Time Machine

SRUM – Another Windows Time Machine

Overview In standard forensics investigations, sooner or later arises the need to find and extract evidence of program execution on...

Case Study Effectiveness of our client’s security implementations red team engagements red teaming

Red Teaming Case Study

To ensure the effectiveness of our client’s security implementations LIFARS frequently conducts red team engagements and penetration tests evaluating whether...

capability to reboot affected devices into Safe Mode Case Study Malware Analysis Case Study Snatch Ransomware

Snatch Ransomware – Malware Analysis Case Study

Overview. During last month LIFARS DFIR Team encountered various variants of Snatch Ransomware. This ransomware is known for its capability...

Investigating Process Objects and Network Activity Technical Guide Windows Memory Forensics

Windows Memory Forensics Technical Guide Part 3

Investigating Process Objects and Network Activity. Generally speaking, an object is a data structure that represents a system resource, such...

Case Study Clipper AutoIt v2 LIFARS DFIR Team discovered QUILCLIPPER AutoIt Malware Qulab Stealer and Clipper malware

Clipper AutoIt v2 – QUILCLIPPER AutoIt Malware

Overview. During a recent engagement, the LIFARS DFIR Team discovered a sample of rare malware, which uses not very common techniques.  It turns out that...

Introduction to Structured Analysis with Volatility Technical Guide Windows Memory Forensics Windows Memory Forensics Part 2

Windows Memory Forensics Technical Guide Part 2

Introduction to Structured Analysis with Volatility.  Investigative Process Steps. Windows Processes. Structured Analysis and Investigative Process After a short introduction...

Introduction to Memory Forensics Unstructured Analysis Memory Acquisition Technical Guide Windows Memory Forensics

Windows Memory Forensics Technical Guide Part 1

Introduction to Memory Forensics Unstructured Analysis. Overview Memory forensics has been a crucial part of an investigation process for some...

Case Study Cryptocurrency Miners Threat Actors Use Targeted Attack XMRig-based CoinMiners by Blue Mockingbird group

Cryptocurrency Miners – XMRig Based CoinMiner by Blue Mockingbird Group

Since the end of March LIFARS DFIR team has observed an increase in the number of incidents related to Monero...

Mining parameters from dark corners of Web Archives ParamSpider Technical Guide

ParamSpider – Mining parameters from dark corners of Web Archives

Have you ever wondered how to scrape all the parameters from domain and subdomains from the past without manually crawling...

923 words on Windows Ntuser.dat Computer Forensics digital forensic investigation LIFARS Tech Diary Technical Guide What is the NTUSER.DAT File in Windows

923 words on Windows NTUSER.dat

With a little bit digging you can discover treasure trove of information, which can be utilized in your digital forensic...