BJ MAC

Casual Observer | DFIR Consultant |

[BJ MAC @_bjmac_]

@DfirDiva @13CubedDFIR 🔥

[DFIR Diva @DfirDiva]

🎁 GIVEAWAY! 🎁

I partnered with @13CubedDFIR for a giveaway of his Investigating Windows Bundle!

This bundle includes 365-day access to the Investigating Windows Endpoints & Investigating Windows Memory courses. It also includes a certification attempt for each!

To Enter: Like, Repost, and Leave a Comment.

On September 28th, entries will be combined from both LinkedIn and Twitter(X) and a winner will be selected and announced.

Learn more about the Investigating Windows Bundle here: https://t.co/ElUg3beE3i

#DFIR #DigitalForensics #IncidentResponse

[Kevin 🤖🕵️🍺 @KevinPagano3]

This has been a labor of love the past few years, check it out! #DFIR @stark4n6

[Microsoft Threat Intelligence @MsftSecIntel]

Multifactor authentication (MFA) manipulation in compromised tenants can be hard to detect, as some changes can be dismissed as part of standard helpdesk processes. Microsoft shares guidance for hunting for MFA anomalies using Kusto Query Language (KQL): https://t.co/FVZ1ZKhPFZ

[Chad Tilbury @chadtilbury]

How Did That Photo Get On That iPhone? https://t.co/QinMBPRn4Q >> A fun walkthrough of iOS database discovery.

[Invictus Incident Response @InvictusIR]

What a glorious day for Incident Responders around the world! Premium audit events in Microsoft 365 are now available to non-premium users.

🚨Action for you:
- Check your mailbox audit settings, details in the blog:
https://t.co/mEkdtozsaO

[Michael Roy @mikeroySoft]

Here’s the big news: VMware Fusion Pro and Workstation Pro are both now available Free for Personal Use!

VCF Division blog:

https://t.co/gm4MC1MQ7P

[Ulf Frisk @UlfFrisk]

MemProcFS memory forensics now supports Windows Hibernation Files!

Thank You @k1nd0ne for your excellent blog entry about the file format!

https://t.co/inOM3l1GIF

[BJ MAC @_bjmac_]

@phillmoore Legend, Phill. Thanks for another 52+1 weeks of updates. HNY.

[dragosr @dragosr]

Turn off link previews on Signal!
(Settings->Chats)
You've been warned, vuln inbound.

[Invictus Incident Response @InvictusIR]

🚨Our cloud incident response courses are now live, register at https://t.co/SSRgUdPwCf

🎉 To celebrate we're giving away three vouchers one for each course, Like & Repost to enter the competition.

🥇 We will announce the winners next Monday

[Kevin 🤖🕵️🍺 @KevinPagano3]

All the talks from the @sansforensics @DFIRSummit 2023 in Austin are now available on YouTube #DFIR https://t.co/HoBnElyZTi

[BJ MAC @_bjmac_]

New blog post, my GCFA certification experience #DFIR #SANS #GCFA #GIAC https://t.co/fDDFXTZgNH

[Ulf Frisk @UlfFrisk]

MemProcFS 5.8 released! Now supports memory analysis and forensics of ARM64 Windows 😀

https://t.co/inOM3l1GIF

[BJ MAC @_bjmac_]

@phillmoore Thanks for another year of updates, Phill. Merry Christmas.

[LetsDefend @LetsDefendIO]

Free Hands-On Course: Memory Analysis 🤩

Sometimes you can not find evidence on disk during analysis. Learn how to do memory analysis and never miss any evidence.

Memory Analysis Procedures
Masqueraded Process
Process Injection
DLL Injection

https://t.co/bP3ml7ioNT

[SANS DFIR @sansforensics]

🚨 Special Broadcast 🚨

Learn what you need to know about @OpenAI ‘s new #ChatGPT bot – and how it affects security. #SANSSpecialBroadcast on Wednesday, Dec 21st at 11:00 am EST with @robtlee @jorgeorchilles @it_audit.

➡️ Register Here: https://t.co/uQSP7vgePg

[BJ MAC @_bjmac_]

This was pretty cool to see, well overdue for another blog post too #DFIR

[SANS DFIR @sansforensics]

🚨 FREE #FOR500 and #FOR508 posters!

When you attend #DFIRCON In-Person you'll receive access to FREE printed posters!

🔺 Windows Forensic Analysis Poster
🔻 Hunt Evil Poster

Join the #DFIR community on Nov 14 - 19 in Charlotte, NC: https://t.co/H1p2Cccepf

#SANSTraining

[BJ MAC @_bjmac_]

Really great points being made by @robtlee in his keynote at #DFIRSUMMIT 👏👏👏