Asif Matadar

Digital Forensics & Incident Response Leader | International Public Speaker | Investor | Entrepreneur | Mentor | U.K. Government Cyber Security Advisory Board

[Asif Matadar @d1r4c]

It was another humbling experience to speak at #OSDFCon for the 4th year in a row! Thank you everyone for your kind words, it is much appreciated. Thank you to @carrier4n6 and @basistechnology for hosting another great #OSDFCon! #DFIR #wsl #linux

[Asif Matadar @d1r4c]

That’s another #taniumCTF concluded at #Converge2021! Congratulations to Team WolfGang for winning this year and to everyone for participating. I'll see you all next year! #corporateespionage #supplychainattacks #dfir #windowsforensics #linuxforensics #memoryanalysis

[Asif Matadar @d1r4c]

30 minutes left and 23925 are the maximum points available! Time is ticking! #taniumCTF #Converge2021 #corporateespionage #supplychainattacks #dfir #windowsforensics #linuxforensics #threathunting #memoryanalysis

[Asif Matadar @d1r4c]

We’re going to conclude in 2 hours’ time and the top of the leader board is close to say the least! #taniumCTF #Converge2021 #corporateespionage #supplychainattacks #dfir #windowsforensics #linuxforensics #threathunting #memoryanalysis #volatility #pcap #networktraffic

[Asif Matadar @d1r4c]

@Pir00t Thank you, kind sir. It is much appreciated.

[Asif Matadar @d1r4c]

@smeukh Thank you, kind sir. I appreciate your kind words, it is much appreciated.

[Asif Matadar @d1r4c]

We’re halfway through #taniumCTF at #Converge2021 and it’s getting very intense at the top of the leader board!

[Asif Matadar @d1r4c]

@smeukh Hey, Direct Message me, please?

[Asif Matadar @d1r4c]

We’re an hour away from #Converge2021 #taniumCTF! The scenario is about Corporate Espionage & Supply Chain Attacks. Challenges will compromise of investigating large-scale intrusions, PCAP Analysis, Network Traffic Analysis, Log Analysis, and Linux Memory Analysis, to name a few.

[Asif Matadar @d1r4c]

@CraigHRowland I couldn't agree more! This Reference Guide might be of use to #DFIR professionals. It's from a talk I gave back in 2019 at #OSDFCon: https://t.co/xje5p9Nekm

[Asif Matadar @d1r4c]

@binaryz0ne @u0pattern lol

[Asif Matadar @d1r4c]

@unixterminal @carrier4n6 @basistechnology Indeed. An updated version of the one I delivered at #WSLConf.

[Asif Matadar @d1r4c]

It was another humbling experience to speak at #OSDFCon for the 4th year in a row! Thank you everyone for your kind words, it is much appreciated. Thank you to @carrier4n6 and @basistechnology for hosting another great #OSDFCon! #DFIR #wsl #linux

[Asif Matadar @d1r4c]

@gleeda @Teck923 @keydet89 @jackcr @Hexacorn @HECFBlog @attrc @bbaskin @hacks4pancakes @0xAmit @B1N2H3X @shortxstack @iamevltwin @jared703 @binaryz0ne @maddiestone @maridegrazia @candicenonsense @malwareunicorn Thank you!

[Asif Matadar @d1r4c]

It was a great experience to speak at @DFRWS! Thank you everyone for your kind words, it is much appreciated. Thank you @B1N2H3X for encouraging me to submit and Dave Loveall for being an excellent Chair! Impressive execution by the organisers and volunteers! #DFRWSUSA2020 #DFIR

[Bletchley Park @bletchleypark]

95% of our income relies on visitors coming through our doors so our closure has had a huge impact on our plans for the future. We need your support.

💸 Make an individual donation
⚙️ Support us through your company
🧱 Sponsor a brick
♥️ Become a friend

https://t.co/kuS7Hq38rB

[Asif Matadar @d1r4c]

New #LOLBin discovered on #WSL2 using wsl.exe to execute arbitrary commands. I've previously shown how to download files using wsl.exe, but it is possible for an adversary to exfiltrate files using wsl with tar over an ssh pipe session without touching known_hosts #infosec #DFIR

[Asif Matadar @d1r4c]

New #LOLBin discovered on Windows Subsystem for Linux 2 (#WSL2) using bash.exe with openssl. It is possible for an adversary to download an arbitrary file using the bash.exe binary on #WSL2 Endpoints with an encrypted session using openssl. #infosec #DFIR

[Asif Matadar @d1r4c]

@Hexacorn Thank you. Yes, I was just speaking to @Oddvarmoe who advised me of this.

[Asif Matadar @d1r4c]

New #LOLBin discovered on Windows Subsystem for Linux 2 (#WSL2) using curl.exe. It is possible for an adversary to exfiltrate files using the curl.exe binary on #WSL2 Endpoints. #infosec #DFIR