Chris Shanahan

Views expressed are my own, and do not reflect past or present employers.

[Chris Shanahan @cshanahan]

@yamatosecurity is absolutely killing it lately, as usual!

[田中ザック (Zach Mathis) @yamatosecurity]

Windows DFIRの友よ〜！🔥

どんなWindowsのフォレンジックアーティファクトでも解析できて、しかも爆速・安定・整理された出力・メモリ安全・スタンドアロン・クロスプラットフォーム対応……そんな夢のようなオールインワンツールが欲しいと思ったことない？

僕はずっと欲しかった！というわけで、この1か月間、ひたすら開発に没頭して作っちゃいました！😎

その名も 「Juntei（准胝）」！🎉

https://t.co/HQXVsGltCq
https://t.co/XhM2jP9Mx4

簡単に言えば、「EVTX以外のアーティファクトを解析するHayabusa」 みたいなものです！
通常のディレクトリはもちろん、VHDXやE01ファイルもマウントせずにそのままスキャンできます！

先ほど、Windowsのトリアージデータ30セット（合計125GB）を使って性能テストをしてみたところ……
なんと！MacBook Pro M4で 5分もかからずに40GBもの解析結果を出力！ 🚀

使い方も超簡単！

auto-parse コマンドを実行するだけで、対応するアーティファクトを全部自動解析してくれます！

さらに、解析結果のディレクトリに対して super-timeline を実行すれば、スーパータイムラインも生成できます！
ただし、ここは要注意！⚠️

「SUPER」という名前は伊達じゃありません（笑）。
現時点では、タイムラインのサイズが解析結果の約5倍にも膨れ上がります！😂
なので、おすすめの使い方は、まずHayabusaでインシデントが発生した日時を特定し、その前後の期間に絞ってタイムラインを作成することです。

ちなみに、JSONL形式のスーパータイムラインは、デフォルトでTimesketchにインポートできる形式になっています！

CSV形式の解析結果を確認するなら、IRFlow Timeline がおすすめ！フィールドの型を正しく認識できるように、専用テンプレートも作成しました。
https://t.co/iczzGaD7NV （v2のリリースを待つか、僕のフォーク版を使ってね！）
macOS版：
https://t.co/wh51vxwcOU
Windows版：
https://t.co/Vav5rnVJ2v
Linux版：
https://t.co/yAg9aBk4sp

ぜひぜひ使ってみてください！🔥

気に入ってもらえたら、周りのDFIR仲間にも広めてもらえるとうれしいです！そして、GitHubのスター⭐もぜひお願いします！ 🙏

Enjoy DFIR！🤗

[Chris Shanahan @cshanahan]

@kepano I happily pay the $48 for all the reasons you mentioned. It is well worth the $

[Costin Raiu @craiu]

Pray that the defenders get access to more powerful models than the attackers - or we’re heading into some very dark times.

[Thomas Poppelgaard @_POPPELGAARD]

Patched NetScalers rebooting today: a SAML exploit tries to drop a persistent kit and crashes them trying. Using SAML? Call Citrix for the workaround.

Free checker v1.10 finds the kit, the crashes, backdoor admins, 58 IPs:
https://t.co/fGlD4MZeiI
#NetScaler

[Manuel Winkel @Deyda84]

Citrix confirms exploitation of CVE-2026-88771 and CVE-2026-88772. My updated NetScaler checklist covers all eight CVEs and includes a read-only triage script. A clean scan does not prove an appliance is uncompromised.

https://t.co/qOT5pjQ5vj

#DeydaConsulting #NetScaler #Citrix

[forloop @forloopcodes]

⚠️⚠️ LINUX KERNEL SOURCE CODE LEAKED!!!

this guy named linus torvalds just reverse engineered linux source code and leaked it on github, all computer systems running on linux are vulnurable

billions of lines of code, 1.5 million commits, 240k stars

all linux users are suggested to switch to windows as soon as possible

[Disturbed @Disturbed]

This was not on our bingo card 🤯🌀

[Chris Shanahan @cshanahan]

Proud parent

[X-Ways Software @XWaysSoftware]

X-Ways Forensics 21.7, X-Ways Investigator 21.7, X-Ways Imager 21.7, and WinHex 21.7 were released yesterday! Details at https://t.co/1K9Llp3kJs.

[Chris Shanahan @cshanahan]

@Zai_org GLM-4.7-Flash running on @ollama is really amazing. Add @opencode and you have a great local set up.

[Chris Shanahan @cshanahan]

Yeah, then go back to working on the bigger threat, #CitrixBleed2

[𝙳𝚊𝚗 @4n68r]

Patch: https://t.co/kVbMIIkBMo

[Chris Shanahan @cshanahan]

Like many IR people, I was having fun with FortiWeb before the Citrix NetScaler fun started. Now I'm dealing with SharePoint.
For all the IR people out there, don't forget to get your usual 3 hours of sleep p/day. It's a marathon, not a sprint.
#CitrixBleed2 #SharePoint #DFIR

[LeakIX @leak_ix]

sharepoint.payload.txt
https://t.co/CVZqxdfMEd

[4 of mallace @IceSolst]

Just got hired at fortinet as the guy who puts in the RCE before releasing to prod

[Horizon3.ai @Horizon3ai]

🚨 #CitrixBleed 2.0? We break down CVE-2025-5777, CVE-2025-5349, and CVE-2025-6543 — what’s known, what’s not, and why admin creds may be at risk.

If you run #NetScaler, read this now 👇
https://t.co/wgpafxDLsj #infosec #cybersecurity

[Nextron Systems @nextronsystems]

We’ve released a CLI utility to transform THOR logs into Timesketch-compatible JSONL for timeline analysis

Correlate findings across hosts and time, enrich your analysis, and integrate audit-trail logs

Supports THOR and THOR Lite

🔗 https://t.co/zEknHKWVXw

[X-Ways Software @XWaysSoftware]

X-Ways Forensics 21.5, X-Ways Investigator 21.5, X-Ways Imager 21.5, and WinHex 21.5 were just released! Details at https://t.co/xNbQedsb8W and later also at https://t.co/1K9Llp3Sz0.

[Chris Shanahan @cshanahan]

This is huge news. Finally

[derek eiri 👻 @MrEerie]

It’s happening!

[Matt Zorich @reprise_99]

That IR life

[Chris Shanahan @cshanahan]

@ArsenalRecon Oh wow... That's a blast from the past. I remember LiveView. I also remember all the blue screens. It was still a great research project at the time.
I love AIM. So, so useful.