Congrats to the @13cubed.bsky.social giveaway winners!

📢 I partnered with @13cubed.bsky.social for another giveaway! 🎁 🏆 1 winner will receive a 13Cubed Investigator T-Shirt + the XPlat Bundle Complete 👕 5 winners will receive 13Cubed Investigator T-Shirts To Enter: Like, Comment, and Repost #DFIR #DigitalForensics #IncidentResponse

Hack The Box is hosting their first all Blue CTF next month! Dates: September 22nd - 26th Form a team and compete for prizes 🏆 Challenges Include: - DFIR - SOC - Malware Reversing - Threat Intelligence Link: ctf.hackthebox.com/event/detail...

Week 17 - 2025 #DFIR thisweekin4n6.com/2025/04/27/w...

I recorded a brief video, walking through some of the different functions in MalChela in the new GUI, stepping through basic static analysis to yara rule writing - all in minutes.

youtu.be/hI1EqojI1DA #DFIR #MalwareAnalysis #YARA #MITRE #Rust MalChela: github.com/dwmetz/MalCh...

This is an interesting write up on a slightly different #Docker #container #malware attack from the Cado Security and Darktrace teams. 🔗 www.darktrace.com/blog/obfusca...

Interested in learning about #DFIR and don't know where to start? Then we highly recommend you check out our full "C5W-100 - Introduction to Digital Forensics" course. It is completely FREE and it should help you get started. #infosec #cybersecurity academy.cyber5w.com/courses/C5W-...

🐍 SLEUTHCON is coming! 🐍 Registration and CFP are now open for this year’s SLEUTHCON—happening June 6th, both in-person in Arlington, VA, and virtually. www.sleuthcon.com 1/x

There's a new Hindsight release! Hindsight v2025.03 focuses on Extensions - parsing more activity and state records, highlighting Extension permissions, and making it easier to examine Manifests. 🌐 Blog: dfir.blog/hindsight-pa... 🛠️ Tool download: hindsig.ht/release #DFIR #Chrome #Extensions

New Autopsy release is out! 🎉 It's been a minute, but it's out. Notable features are BitLocker support and it can run side-by-side with Cyber Triage. Plus, a bunch of library updates. Now Cyber Triage and Autopsy can be used on the same case at the same time! www.autopsy.com/autopsy-4-22...

New Blog Post! Free & Affordable Training News Monthly: Feb - Mar 2025 - Newly released DFIR, OSINT, and Malware Analysis training, tools, and books from February 2025 - Upcoming events for March 2025 Link: dfirdiva.com/free-afforda... #DFIR #IncidentResponse #MalwareAnalysis #OSINT

I noticed the DFIR & Blue Team Certifications + Training for under $1,000 section had a lot of broken links. They've been fixed 🙂 training.dfirdiva.com/listing-cate... #DFIR

Missed the @magnetforensics.bsky.social Virtual Summit #CTF but want the images for testing and learning? We have already shared them with @nist.bsky.social CFReDS cfreds.nist.gov/all/Hexordia...

New #iLEAPP 2.1.0 release is out! #DFIR github.com/abrignoni/iL...

Ultimate Cybersecurity Career Humble Bundle! Includes: - Incident Response for Windows - The OSINT Handbook - Effective Threat Investigation for SOC Analysts and more! Link: humblebundleinc.sjv.io/kOaeod (Partner Link) #DFIR #IncidentResponse #MalwareAnalysis #Cybersecurity #OSINT

DFIR Giveaway! You could win: ✅A FREE @detegoglobal.bsky.social Digital Forensics & Cyber Crime Investigations course worth $399 each ✅Detego merch pack ✅‘Force of Justus’ crime novel Enter here: detegoglobal.com/dfirdiva THREE winners will be announced March 10th, 2025! #DFIR

Free & Affordable Training News Monthly: Dec 2024 - Feb 2025 - Newly released DFIR, OSINT, and Malware Analysis training, tools, and books from Dec 2024 & Jan 2025 - Upcoming CTFs and training for February, 2025 Link: dfirdiva.com/free-amp-aff... #DFIR #IncidentResponse #MalwareAnalysis #OSINT

The winner of the @13cubed.bsky.social XPlat Bundle is @dfirjw.bsky.social! Congrats!

Happy New Year! I partnered with @13cubed.bsky.social for a giveaway of his XPlat training/certification Bundle! To Enter: Like, Repost, and Leave a Comment On January 12th, 1 winner will be chosen from LinkedIn and 1 winner will be chosen from Bluesky. #DFIR #DigitalForensics #IncidentResponse

"Mastering Sysmon: Deploying, Configuring, and Fine-Tuning" A free mini eBook for #DFIR professionals with practical steps to deploy, fine-tune, and start logging with Sysmon. dfirinsights.com/2024/11/27/m... #infosec #blueteam

PSST: our 1-day OSINT 101 (for beginners) class is free! academy.plessas.net/offers/iFJiA...

I have 76 feeds in this list. Next week I will add more podcasts, but if I am missing important blogs (and I KNOW I am), give me a hand. Don't be shy - post your own blogs too. #OSINT knowledgebase.plessas.net/OSINT-Feeds-...

Just a heads up. M$ is OCRing all your images in OneDrive for business in an unsecured database on your desktop/laptop. Happy Friday. #DFIR

We uploaded a new #OSINT challenge for you to try your hand at. Can you identify the Latitude and Longitude of where this photo was taken? www.youtube.com/shorts/6iYuE...

Great spreadshit for #DFIR to know if something was executed - blog.1234n6.com/available-ar...

Accelerated Rust Windows Memory Dump Analysis (ISBN-13: 978-1912636891) is now available in PDF format with and without recording and additional materials: www.patterndiagnostics.com/accelerated-...

Want to take part in the Magnet Virtual Summit #CaptureTheFlag competition? Let @b1n2h3x.bsky.social share some helpful info, including what's new (like the ability to play in teams), how to take part, and where to get some tips & tricks: ow.ly/mHW350UkTXe #MVS2025 #CTF #DFIR

2024-12-04 (Wednesday): #AgentTesla variant using #FTP for data exfiltration. A sanitized copy of the email distributing the malware, a #pcap from an infection run, the associated malware samples, and a list of indicators are available at www.malware-traffic-analysis.net/2024/12/04/i...

Come join us tomorrow #DFIR

Go back to the basics when leveraging OSINT for your investigations. Google Dorking is a great example. Using search operators can greatly reduce the number of search results while increasing accuracy. Site:bsky.app Privacy Privacy policy from Bluesky. Wanna try more Osmosis.ctfd.io check it out!

Really pleased to complete the five Bellingcat open source puzzles on day one. If you want to play along, you can join in at challenge.bellingcat.com Enjoy! #Bellingcat #OSINT #Investigations #Geolocation

#DFIR 💭 of the day: Collaboration between practitioners and academia is crucial. To get ahead of rapid changes in #DFIR, we need scientific study and research! This is the largest scientific survey of DFIR practitioners. Must read to understand current issues www.sciencedirect.com/science/arti...

It’s #CyberMentoringMonday!!!! Are you looking for a professional mentor or to learn more about InfoSec? Are you experienced and willing to ‘give back’? Use this thread and hashtag to connect!

The Layer 8 Conference is back! Saturday, June 14 in Boston! More info here: layer8conference.com Hope to see you there! #OSINT #SocialEngineering

Happy Cyber Monday! 🎉 A brand-new 13Cubed episode on NTFS FILE record reuse is out now. Dive into the details and don’t forget—today’s the final day to save 13% on all 13Cubed training courses with code BLACKFRIDAY2024. Ends at 00:00 UTC Dec 3. www.youtube.com/watch?v=6LpJ... #DFIR

🌟New report out today!🌟 The Curious Case of an Egg-Cellent Resume Analysis & reporting completed by @_pete_0, @svch0st and guest contributor @k3dg3 from @proofpoint! Audio: Available on Spotify, Apple, YouTube and more! thedfirreport.com/2024/12/02/t...

2024-11-26 (Tuesday): Finally got another traffic analysis exercise out! You have a #pcap and alerts on the network traffic. You're asked to write an incident report. Join the fun at www.malware-traffic-analysis.net/2024/11/26/i... #Wireshark #TrafficAnalysisExercise

This festive season I’m sharing a video every day for the next 24 days showing useful OSINT tools & techniques. Creating this OSINT Advent Series has been a lot of fun and I hope it’s helpful for the ever-growing OSINT community! 🎄👇

I have created a starter pack to shine light on organizations that make notable contributions back to the #infosec community in the form of generous free tiers, valuable webinars, trainings, resources, etc. I am sure there are others, just DM or reply with any suggestions! go.bsky.app/NMbiTUL

Free & Affordable Training News Monthly: November - December, 2024 Curated Newly Released DFIR & OSINT Training, Books, Tools & Challenges from November Upcoming Live Training, Events, and CTFs for December Link: dfirdiva.com/free-afforda... #DFIR #DigitalForensics #IncidentResponse #OSINT

#Stark4N6: Forensics StartMe Updates (12/1/2024) #DFIR www.stark4n6.com/2024/12/fore...

Week 48 - 2024 #DFIR thisweekin4n6.com/2024/12/01/w...

Would you like to develop tools or methods that can support online researchers? Do you have a project idea that could benefit the open source research community? Bellingcat’s Tech Fellowship could be the opportunity to do just that, apply here: www.bellingcat.com/bellingcat-t...

🚀 New OpenRelik release Role-based access control, folder sharing, database improvements, optimisations for file listings, chunked file uploads, bug fixes and refactoring efforts to improve stability. 📝 https://openrelik.org/changelog/ 🔗 https://discord.gg/hg652gktwX #DFIR

I just created my first starter pack. This one is for women in infosec. Please follow and share, and lmk if you’d like to be added! go.bsky.app/HAGHpCr

New Blog Post! Free & Affordable Training News: Black Friday 2024 Edition Can't afford the discounts? I also mention any free content I know of related to each deal. dfirdiva.com/free-afforda... #DFIR #DigitalForensics #IncidentResponse #MalwareAnalysis #OSINT

🚨 #DFIR Tool update 🚨 I’ve updated parseUSBs (again!): - Now supports mounted #KAPE images - Improved deduplication of events within secs of each other - Added extraction of partition style (MBR/GPT) & Filesystem - Parses alternate S/Ns - Parses WPDBUSENUM key github.com/khyrenz/pars...

I need your help. I'd need software I can use to make, maintain, and publish to my team a Standard Operating Procedures (SOP) wiki/set of docs. Ideally, a few people could write the docs and then it gets published internally for all to read. Please share for reach....I'm open to your ideas! #osint

#DFIR 💭 of the day: “Deleted” doesn’t provide necessary nuance. A red X doesn’t always mean “deleted” - which infers user action to lay folks. Recovered data reasons depend on function & data structure. Analysis is our role. Paper on Classification of Recovered Dara tsapps.nist.gov/publication/...

I know you nerds love 7zip -- might want to update it as I am pretty sure it does not self-update. securityonline.info/cve-2024-114...