Archive - Eric’s Substack

Introduction to YARA

The Swiss-army knife of malware detection.

Mar 11 •

December 2024

The Role of Fuzzy Hashes in Security Operations

Enhancing Malware Analysis with Similarity-Based Hashing Techniques

Dec 19, 2024 •

October 2024

Atomic & Stateful Detection Rules

Harnessing the Power of Precision and Context in Detection Engineering

Oct 14, 2024 •

April 2024

Prefetch Analysis Lab

Analyze evidence of execution artifacts from a data breach investigation.

Apr 29, 2024 •

November 2023

So you want to be a SOC Analyst? 2.0

A revamp of the original SYWTBSA blog series, made much easier with cloud-hosted VMs. All you need is a web browser!

Nov 3, 2023 •

October 2023

Threat Hunting with Velociraptor - Long Tail Analysis Lab

Leverage "rarity" in Velociraptor hunts to identify outliers with a hands-on lab using data generated from 10 systems, one of which is compromised.

Oct 28, 2023 •

May 2023

VMware Memory Analysis with MemProcFS

A lab guide for analyzing an infected memory image of a running VMware system with MemProcFS.

May 27, 2023 •

April 2023

Capturing & Parsing Forensic Triage Acquisitions for Investigation Timelining

This guide will walk you though capturing and processing triage acquisitions into forensic timelines, step-by-step, with a VM containing all needed…

Apr 12, 2023 •

March 2023

Find Threats in Event Logs with Hayabusa

A powerful technique for finding threats in Windows event logs.

Mar 21, 2023 •

A "Thank You" to Paid Subscribers

I sincerely want to thank those of you that are supporting this blog. Here are some resources just for you.

Mar 20, 2023 •

Mounting E01 Forensic Images in Linux

So you want to mount an E01 forensic image? This guide will help.

Mar 10, 2023 •

Live Incident Response with Velociraptor

A video walk-through of incident handling using the open source Velociraptor agent

Mar 3, 2023 •

#nojs-banner { position: fixed; bottom: 0; left: 0; padding: 16px 16px 16px 32px; width: 100%; box-sizing: border-box; background: red; color: white; font-family: -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 13px; line-height: 13px; } #nojs-banner a { color: inherit; text-decoration: underline; } This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts