Cat

Incident Response consultant

[DirectoryRanger @DirectoryRanger]

Interested in RDP DFIR? – Then this @WEareTROOPERS #TROOPERS23 talk is for you:
Forensic analysis on real incidents inside Microsoft Remote Desktop Services
https://t.co/QMBXpi1d6k

[Cat @catdfc]

@bunsofwrath12 Hi Andrew, the issue we encountered is that the tool does not properly process SRUDB.dat databases from Windows Server 2022 due to the tables being unknown.

[Cat @catdfc]

As part of the research my colleagues and I presented at #DFIREurope23 🇨🇿 (https://t.co/4HQdF8iWvr), I updated Chainsaw. It is now capable of analysing SRUM databases and providing new forensic insights 💡(see https://t.co/WGiKSmxepo)
#chainsaw #dfir #SRUM #WithSecure #SANS

[WithSecure™ @WithSecure]

Unleash the Power of Shimcache with Chainsaw!

WithSecure researchers release new subcommand for its Chainsaw forensic tool to aid the analysis and timestamp enrichment of Shimcache entries.

More info available here>> https://t.co/0g2XPsy0Jr

#CyberAttack #incidentresponse

[Faith @f0xtrot_sierra]

We had an interesting lateral movement case the other day @HuntressLabs here’s what we found:

We found that the remote IP address used by the threat actor to RDP was 185[.]190[.]24[.]101

We also had failed log in attempts from 194[.]26[.]29[.]25

[WithSecure™ @WithSecure]

NEW RESEARCH: WithSecure Labs publishes a report documenting the movement of SILKLOADER from Chinese cyber criminals to Russian #ransomware gangs, including CONTI and it’s various affiliates/offspring.

Read the report here--> https://t.co/6RgzjqAUs9

#SILKLOADER #Cyberattack

[WithSecure™ @WithSecure]

NEWS: WithSecure™ has discovered a new Infostealer Malware, dubbed “DUCKTAIL” which can hijack Facebook Business accounts
https://t.co/lUnm6R5l3h

#CyberAttack #cybersecurity #malware #Facebook