Dropped our Practical Windows Forensic Analyst cert! 🔥👀 bluecapesecurity.com/pwfa

Is this still on?

Just dropped: Our hands-on Windows Forensics investigation scenarios are live! 🔍 -> 20% OFF with code START200 bluecapesecurity.com/practice/#FO... Enjoy!

We just released a course that embodies our core principles: learn + practice + assess > and it’s free! DFIR Foundations and Techniques: Professional Skills and Readiness => For SecOps and DFIR professionals Full course: tinyurl.com/mu77u3ab Youtube playlist: tinyurl.com/2s3n7nfx #dfir #secops

Still reminiscing about the incredible time at @wildwesthackinfest.bsky.social last week and now counting down to IntelliCon next week in Austin! If you haven’t grabbed your ticket yet, there’s still time: www.intelliguards.com/event-detail...

Final modules for our 301 Enterprise DFIR course have been uploaded. What a journey after developing, analyzing and recording all the materials over many months of work! I'm excited about the course and also looking forward to head to the WWHF conference next week. Reach out if you are there!

Proud to present our brand new training page and offering for individuals @ Blue Cape Security: - 301 Enterprise DFIR course launched - HERO Bundle including 101 / 201 / 301 courses - Blue Team Master Program is public again bluecapesecurity.com/individual-t... HMU for questions or feedback! 💙

We have a giveaway of our brand new course bundle over at LinkedIn for those interested: www.linkedin.com/posts/blueca... Only 2 more days!

Lots of great things coming next week! 301 Enterprise DFIR course - Launch Party with a special guest, new course bundles and more! Live Stream: youtube.com/live/MgG_pT1...

Since enabling Apple Intelligence an uncontrollable amount of notifications keep popping up (e.g. continuously when I'm screen sharing on Zoom). It doesn't seem they've gotten much smarter navigating me to my webinars either..

🚀 Excited to announce the alpha release of NIMS - a Notion-based Incident Management System! Designed for SOC/IR teams, NIMS helps streamline incident management and collaboration using Notion's powerful database features. #InfoSec #DFIR #IncidentResponse #SecOps #Notion

How do you track DFIR timelines and findings? There doesn't seem to be a one size fits all solution in the industry. Most commonly used are still spreadsheets, where Crowdstrike actually released a pretty nice IR Tracker template a while ago: www.crowdstrike.com/en-us/blog/c...

The best conference in the industry is only 1 month away 🤠 I'll be teaching the 2-day Ransomware Attack Simulation and Investigation for Blue Teamers workshop with in-person and virtual seats available! I’m looking forward to reconnecting with old friends and making new ones at this amazing event!

For those looking to practice a realistic #DFIR scenario, here is a free case for you to investigate. Provided artifacts: - Disk Triage Collection - Memory Image + pagefile.sys: - PCAP File Link: bluecapesecurity.com/courses/elev...

AWS: Welcome back! Your t2.xlarge EC2's have been running happily over the holidays 🥲

Practical Windows Forensics - Cheat sheet 💙 Full PDF version: github.com/bluecapesecu...

Looking forward to present our maturity model tomorrow live! Finally visualized the way how we do trainings for teams and individuals. Link: bluecapesecurity.com/register

Microsoft incident data sets. Haven’t had a chance to test this, but certainly looks interesting. www.kaggle.com/datasets/Mic...

Oh hey we have a webinar coming up next week! -> Thursday, December 19th I'll be sharing our DFIR Training Roadmap that we've been working on since the beginnings of Blue Cape Security (which is more than 2 years now) 🥹 us06web.zoom.us/webinar/regi...

Was just planning on releasing a new DFIR course module on log analysis, but I just uploaded: 2+ hours video 11 Splunk hands-on labs (with over 30 queries) 2 Sigma hands-on labs Why do these things always get out of hand?

Currently working on a course module using Sigma detection rules. A few resources I came across and didn't know about previously were: - Sigma rule search engine: sigmasearchengine.com - Sigma VSC plugin: marketplace.visualstudio.com/items?itemNa... Making Sigma rule creation much more fun :)

Any one have any recommendations for video cutting tools? Just for effective cutting of recorded videos for courses. Wondershare Filmora is pretty good, but always curious about what else is out there.

Revolutionizing Security Operations: The Path Toward AI-Augmented SOCs open.substack.com/pub/software... Highly recommend this post to get a grasp on how AI is transforming security operations.

A curated list of Windows execution artifacts - this is just awesome work by @harrisonamj.com! blog.1234n6.com/available-ar...

I couldn't agree more! ...personnel are responsible for maximizing the use of technology, streamlining processes, and honing their skills to identify and address current and emerging threats. My take on how people can do more with less: www.linkedin.com/posts/markus...

For course creators there's nothing worse than having to ensure students are downloading entire VMs, installing applications on various OSs, getting licenses etc, only to tell them about updates and changes further down the road. Especially, with on-demand trainings.

About to drop PCAP and Zeek log analysis modules for the new 301 DFIR course @ Blue Cape Security! Let the Ransomware scenario investigation begin 🔍

Excited to share that our 301 Enterprise DFIR course is now open for enrollment! Join now to get drip-content releases weekly: bluecapesecurity.com/courses/301-... And we started our Black Friday sale! Code *BLACKFRIDAY24* gets you 25% OFF on all courses and bundles: bluecapesecurity.com/courses/

Starter Pack containing #infosec trainers — if I missed any, lmk! go.bsky.app/V5iocw6

I've been playing around with various cloud-based solutions to set up labs and forensic workstations for our DFIR workshops. Specifically, we want to use a Windows 2022 host and Ubuntu WSL (based on this guide, which is based on VirtualBox bluecapesecurity.com/build-your-f...). 🧵

Making my first post here and already trying to be useful. 💡 I just came across this nugget while preparing for our DFIR class next week. There is a cheat sheet for Splunk SPL out there: www.splunk.com/en_us/blog/l... (pdf at the bottom)