Archive - Eric’s Substack

The Role of Fuzzy Hashes in Security Operations

Enhancing Malware Analysis with Similarity-Based Hashing Techniques

Dec 19 •

October 2024

Atomic & Stateful Detection Rules

Harnessing the Power of Precision and Context in Detection Engineering

Oct 14 •

April 2024

Prefetch Analysis Lab

Analyze evidence of execution artifacts from a data breach investigation.

Apr 29 •

November 2023

So you want to be a SOC Analyst? 2.0

A revamp of the original SYWTBSA blog series, condensed and self-contained in a cloud-hosted lab VM. No local VM required!

Nov 3, 2023 •

October 2023

So you want to be a SOC Analyst? Part 6

Let's get a little more advanced with our detection rules by leveraging automated YARA scanning.

Oct 30, 2023 •

So you want to be a SOC Analyst? Part 5

So now you can write detections, which means you will soon learn about false positives; let's practice tuning those.

Oct 29, 2023 •

Threat Hunting with Velociraptor - Long Tail Analysis Lab

Leverage "rarity" in Velociraptor hunts to identify outliers with a hands-on lab using data generated from 10 systems, one of which is compromised.

Oct 28, 2023 •

May 2023

VMware Memory Analysis with MemProcFS

A lab guide for analyzing an infected memory image of a running VMware system with MemProcFS.

May 27, 2023 •

April 2023

Capturing & Parsing Forensic Triage Acquisitions for Investigation Timelining

This guide will walk you though capturing and processing triage acquisitions into forensic timelines, step-by-step, with a VM containing all needed…

Apr 12, 2023 •

March 2023

#nojs-banner { position: fixed; bottom: 0; left: 0; padding: 16px 16px 16px 32px; width: 100%; box-sizing: border-box; background: red; color: white; font-family: -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 13px; line-height: 13px; } #nojs-banner a { color: inherit; text-decoration: underline; } This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts