Archive - Eric’s Substack

New

Top

Discussion

VMware Memory Analysis with MemProcFS

A lab guide for analyzing an infected memory image of a running VMware system with MemProcFS.

May 27 •

April 2023

Capturing & Parsing Forensic Triage Acquisitions for Investigation Timelining

This guide will walk you though capturing and processing triage acquisitions into forensic timelines, step-by-step, with a VM containing all needed…

Apr 12 •

March 2023

Find Threats in Event Logs with Hayabusa

A powerful technique for finding threats in Windows event logs.

Mar 21 •

A "Thank You" to Paid Subscribers

I sincerely want to thank those of you that are supporting this blog. Here are some resources just for you.

Mar 20 •

So you want to be a SOC Analyst? Part 4

Now that we've detected attacks, let's learn to actively block an attack.

Mar 20 •

Mounting E01 Forensic Images in Linux

So you want to mount an E01 forensic image? This guide will help.

Mar 10 •

Live Incident Response with Velociraptor

A video walk-through of incident handling using the open source Velociraptor agent

Mar 3 •

February 2023

So you want to be a SOC Analyst? Part 3

Emulating an adversary for crafting detections

Feb 24 •

So you want to be a SOC Analyst? Part 2

Put on your adversary hat, it's time to make (and observe) some noise

Feb 24 •

So you want to be a SOC Analyst? Part 1

Set up a small virtualization environment (2 small VMs)

Feb 24 •

So you want to be a SOC Analyst? Intro

A blog series for someone wanting to get a start as a SOC Analyst

Feb 22 •

PowerShell Artifact - ConsoleHost_History.txt

A great way to understand adversary PowerShell activity on a system.

Feb 16 •

#nojs-banner { position: fixed; bottom: 0; left: 0; padding: 16px 16px 16px 32px; width: 100%; box-sizing: border-box; background: red; color: white; font-family: -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 13px; line-height: 13px; } #nojs-banner a { color: inherit; text-decoration: underline; } This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts