Corey Harrell

Random thoughts running through my mind ... Mostly focused on information security though

[Corey Harrell @corey_harrell]

"CCM_RecentlyUsedApps Properties & Forensics" https://t.co/FyFL2P1sL0

[Corey Harrell @corey_harrell]

"Secret Archives of Execution Evidence: CCM_RecentlyUsedApps" https://t.co/soNaagAaPu

[Corey Harrell @corey_harrell]

"Incorporating AmCache data into Timeline Analysis" https://t.co/zFXPcPqjtM

[Corey Harrell @corey_harrell]

@DavidPany @EricRZimmerman Can't answer that one since I haven't done any testing involving it

[Corey Harrell @corey_harrell]

New and long overdue jIIr post: Changing Perspectives https://t.co/hGQHXGQ8aT #DFIR #IamBack

[Corey Harrell @corey_harrell]

"7 Mistakes of InfoSec defense" https://t.co/d0xR4FnsD8

[Corey Harrell @corey_harrell]

@cmatthewbrooks a little late response. I don't think I ended up releasing it. I may circle back around to update it.

[Corey Harrell @corey_harrell]

@keydet89 @DFIR_tools @maridegrazia It will be helpful as I try to get back online and get caught up on new blogs

[Corey Harrell @corey_harrell]

@infosecb the program I am associated with is the MS in digital forensics

[Corey Harrell @corey_harrell]

@infosecb thanks for clarifying. That slide deck was a local con and I was trying to show how I do RCA for infections

[Corey Harrell @corey_harrell]

@keydet89 @DFIR_tools @maridegrazia thanks. Kinda surprised I made any list. For the past year I pretty much dropped offline

[Corey Harrell @corey_harrell]

@infosecb which slide deck did you see? Those aren't public.

[Corey Harrell @corey_harrell]

Sweet. PFIC is in Albany, NY this year. #DFIR conferences never come to New York and this one is in my neck of the woods.

[Jack Crook @jackcr]

Tired of traveling and defending orgs you have no stake in? GE-CIRT is always looking for talented, passionate people. DM for details #DFIR

[Corey Harrell @corey_harrell]

@505Forensics I will try to submit a CFP for a con next year for a security monitoring technique

[Corey Harrell @corey_harrell]

My session summary. Blah, blah, blah, our product, blah, blah, our product, blah, blah, blah, our product. It's not a con; it is sales

[Corey Harrell @corey_harrell]

Gave it a try on Day 1. Went to local con, saw the sessions, sat through one session, and then decided I'd rather be at work.

[Andrew Case @attrc]

If you ever see/read vendors talking about ‘automating’ threat hunting then you should run away as fast as possible #DFIR

[Andrew Case @attrc]

Really nice work from @hiddenillusion on Prefetch hashing, full path calculation, and memory forensics: https://t.co/3gdrAcoAQr #DFIR

[Corey Harrell @corey_harrell]

"A collection of PHP backdoors" https://t.co/QasfSE0EDK