Erik

[Fox-IT @foxit]

🚀 Our open-source Dissect project now supports reading Fortinet firmware files! 🛡️ Easily mount, browse or dump FortiGate firmware files hassle-free with Dissect. No extra steps needed! #Dissect #Fortinet #FortiGate #Firmware

https://t.co/fNMFWt3Voz

[Erik @Schamperr]

@noperator @bishopfox Support for this was added to Dissect earlier this year, with all current encryption keys added last week (#568)! Unfortunately the described method in the blog doesn’t work as well for other processor architectures.

https://t.co/uJAQSYrUkI

[Erik @Schamperr]

@_JohnHammond A parser for this is in Dissect currently in review! https://t.co/nR7GksDEfx

[Fox-IT @foxit]

Read our latest blog to find out how our Security Research Team reverse-engineered Windows Defender to uncover previously undocumented artefacts, which can now be recovered using Dissect!
https://t.co/zpgZ8UMFkc

[Fox-IT @foxit]

In addition: we're proud to announce the release of Dissect 3.8.1!

One of the new exciting features is preliminary support for Citrix Netscaler appliances!

Read more about it and how to triage Citrix Netscaler appliances in our blog 👇

[Erik @Schamperr]

Includes a triage script for Citrix Netscaler disk images, nicely highlighting the flexibility of Dissect!

[Fox-IT @foxit]

🚨Fox-IT and @DIVDnl have revealed that a exploitation campaign targeting Citrix NetScalers has backdoored approximately 2K NetScalers worldwide! Check your NetScalers for indicators of compromise, even after patching CVE-2023-3519!🔒
🔗blog: https://t.co/yyvfnCp86e

[Dirk-jan @_dirkjan]

Now up at @BlackHatEvents Arsenal are @Schamperr and @Horofic to demonstrate the dissect forensic framework https://t.co/iSdlQBhcnE

[Erik @Schamperr]

@chadtilbury Dissect has a plugin (and API) available for interacting with offline WMI data! “target-query -f cim HOST.E01” and you’re off to the races.

[Peter Rydzynski @PeterRydzynski]

@YunZhengHu Thanks for making me laugh out loud while at work this week!
https://t.co/a4PfyXK9Iw

[Erik @Schamperr]

@JamesSjaalman @foxit Not intentional, but dissect.cstruct (what we use to parse these definitions) is a little permissive when it comes to missing semicolons, so it didn't blow up.

[Erik @Schamperr]

@JamesSjaalman @foxit Fixed :)

[Fox-IT @foxit]

While we wait for the PR to merge dissect.esedb support into #Impacket, you can already enjoy a 500-1000% performance bump yourself by using our Dissect #secretsdump shim!

Read more here: https://t.co/dmbZnmGHMx

[Fox-IT @foxit]

Attention digital forensics and IR specialists!

Dissect Release 3.5 is here with new plugins for virus scanner logs, package managers, and webservers. Plus zcat & zless commands in target-shell, and Linux /proc /sys support for Acquire. Check it out!
https://t.co/4UEgQkOwu5

[Erik @Schamperr]

@cyb_detective @ish_dante Be sure to check out Dissect! https://t.co/BaCu3cWkOC

[Erik @Schamperr]

@KevinPagano3 At @foxit we got rid of full disk images for 99% of the investigation in 2018. Only necessary if the investigation requires it. Made possible by Acquire and Dissect: https://t.co/TeVAjRRDZd

[Erik @Schamperr]

@13CubedDFIR We already received a merge request from the community (that’s almost ready!) that adds support for this to Dissect!

https://t.co/xdPdeMDgCn

[SANS Institute, EMEA @SANSEMEA]

🎙️ #CyberThreat22 attendees, we are live with @Schamperr & @lennarthaagsma presenting Enterprise IR: live free, live large.

Attendees are learning about dissect, its capabilities and methodology.

🔗 https://t.co/6loFUAmijS
#IncidentResponse

[Erik @Schamperr]

@0xdeaddood ~500-1000% performance improvement for https://t.co/Hy2jzxy2bt ;) https://t.co/zwcmEnF7j9

[Yun @YunZhengHu]

In this blog post, we share our research on version identification of Citrix ADC and Gateway servers and how we measured the update adoption on the internet for CVE-2022-27510 & CVE-2022-27518, two critical CVEs with a CVSS v3 score of 9.8
https://t.co/ikFg8kdoTO