Evild3ad79

[Phill Moore @phillmoore]

Week 23 - 2026 #DFIR
https://t.co/LfhdVDbfnj

[LETHAL FORENSICS @LETHAL_DFIR]

Happy to announce the release of Microsoft-Analyzer-Suite v1.8.0! This update includes the release of UALGraph-Analyzer v0.1 with DuckDB as database backend for fast analytical queries. 🚀
#M365 #EntraID #BEC #Security #DFIR
https://t.co/qNF4MqZ6Dk

[Renzon @r3nzsec]

IRFlow Timeline v1.0.7 is live.

This one focuses on a problem I think DFIR teams will see more often: AI assistant usage becoming part of the investigation surface.

You can now collect and normalize local AI usage history from tools like Claude Code, ChatGPT Desktop, Cursor, GitHub Copilot, OpenAI Codex, Gemini CLI, Continue, Windsurf, and Claude Desktop into a unified timeline view.

Also added AI Secret Hunt, which helps identify secrets, tokens, API keys, private keys, and credentials that may have been pasted into AI assistants during real investigations or day-to-day engineering work.

The goal is simple: make AI app activity easier to preserve, search, tag, and correlate during incident response. AI usage is becoming part of the forensic record. We need tooling that treats it that way.

Link in the comment ⬇️

#DFIR #IncidentResponse

[Mr.Z @zux0x3a]

Excited to share the first release of Aether, a memory forensics and threat hunting tool I've been building! written in Zig ⚡
heck out the full write-up on the internals and approach here:
https://t.co/mOu9ZU2fUD

[Evild3ad79 @Evild3ad79]

@_xDeJesus Based on the research by https://t.co/WBMMUlz8Zq

[Evild3ad79 @Evild3ad79]

@_xDeJesus https://t.co/m6q9opyJz2

[Evild3ad79 @Evild3ad79]

@_xDeJesus Another nice thing in UAL: UserAuthenticationMethod Bitfield Mapping

https://t.co/9wJQO2QHBP

[Renzon @r3nzsec]

Just shipped IRFlow Timeline v1.0.6. Spent the Eid holidays finalizing a few new features I’ve been dying to get into the tool since the last release.

What's new:

Sigma Detection
Run Sigma rules directly on raw EVTX folders using the bundled Hayabusa engine (thank you @yamatosecurity) or on imported timelines and EvtxECmd output via an in-app JS engine.

RDP Bitmap Cache Recovery
Extract and reconstruct bitmap tiles from Windows bcache*.bmc / cache????.bin artifacts. Useful for recovering screenshots of what a threat actor actually saw during an RDP session.

150+ Module Refactor
The app was previously a monolithic ~20,000-line codebase (a single App.jsx + parser.js). It's now decomposed into ~150 focused modules across the renderer and main process. Built for scale.

Give it a try and let me know what you think. Always open to feedback from the field. These features were built to test the latest Claude 4.8 with ultracode -xhigh + workflows, backed by Codex 5.5 + Cursor composer 2.5 side by side for lightweight tasks such as updating docs.

[Arsenal Recon @ArsenalRecon]

We just released Hibernation Recon v1.2.3.96 with some awesome updates - Windows 24H2 & 25H2 support, new decompression algorithms, now runs on Windows on Arm & Linux, etc. How do you analyze Windows hibernation? https://t.co/w8v2JqX7rn #DFIR

[DirectoryRanger @DirectoryRanger]

PowerShell DFIR 2026: from MemProcFS-Analyzer to KAPE-style mini-timeline
https://t.co/zO9IT9NkpP

[Phill Moore @phillmoore]

Week 21 - 2026 #DFIR
https://t.co/po91hNfKSH

[Invictus Incident Response @InvictusIR]

The second part in our Kubernetes Incident Response series is live on Google Kubernetes Engine (GKE).

https://t.co/4GFYCxYmWg

🔹 Standard vs. Autopilot Forensics: Why choosing Autopilot means you lose node-level access and how to adjust your IR plan accordingly.

🔹 The Logging Gap: Admin Activity logs are on by default, but Data Access logs (the ones that show secret enumeration and unauthorized execs) are not. If you don't enable them now, that evidence is gone forever.

🔹 Containment without Contamination: How to use NetworkPolicies to quarantine a compromised pod without tipping off the attacker or destroying volatile evidence.

🔹 Querying Cloud Logging: Practical examples of how to hunt for kubectl exec abuse within GCP.

#stayInvictus #CloudIncidentResponse #k8s

[Invictus Incident Response @InvictusIR]

The first part of our incident response in Kubernetes (K8s) blog series is now live!

Incident Response in Kubernetes (EKS) 🏗️

https://t.co/1eOGCcXRw1

#stayInvictus #CloudIncidentResponse #EKS #KubernetesForensics

[Fabian Bader @fabian_bader]

In my latest blog "Now You See Me: AADGraphActivityLogs" I explore the newly released Azure AD Graph logs and demonstrate how you can detect tools like ROADtools and AADinternals that rely on this API and have been under the radar for defender so far.

https://t.co/TXlkbsqKHa

[Invictus Incident Response @InvictusIR]

We’ve received quite a few messages over the past few days about Get-UAL being broken. It turns out Microsoft made an update that impacted the script, but this has now been fixed in our latest release.

𝘜𝘱𝘥𝘢𝘵𝘦-𝘔𝘰𝘥𝘶𝘭𝘦 -𝘕𝘢𝘮𝘦 𝘔𝘪𝘤𝘳𝘰𝘴𝘰𝘧𝘵-𝘌𝘹𝘵𝘳𝘢𝘤𝘵𝘰𝘳-𝘚𝘶𝘪𝘵𝘦

While we were at it, we also added some additional features and improvements. Check out the release notes for all the details.

https://t.co/qYovWFuasM

#stayInvictus #CloudIncidentResponse #MicrosoftExtractorSuite

[Invictus Incident Response @InvictusIR]

𝐀𝐀𝐃𝐆𝐫𝐚𝐩𝐡𝐀𝐜𝐭𝐢𝐯𝐢𝐭𝐲𝐋𝐨𝐠𝐬: 𝐇𝐨𝐰 𝐭𝐨 𝐃𝐞𝐭𝐞𝐜𝐭 𝐋𝐞𝐠𝐚𝐜𝐲 𝐀𝐳𝐮𝐫𝐞 𝐀𝐃 𝐆𝐫𝐚𝐩𝐡 𝐀𝐭𝐭𝐚𝐜𝐤𝐬

Today is a great day for Blue Teamers in the Microsoft Cloud!

There are finally logs streaming into the #aadgraphactivitylogs table. If you want to know what's inside the logs and how to detect some #RoadRecon check out our write-up 👇

https://t.co/ttwOWo2i06

#stayInvictus #CloudIncidentResponse

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

New tool released: #FlowCarp
🔍️Identifies protocols without port numbers
🔨 Build protocol detection from example traffic
➡️ Input: PCAP or PcapNG
⬅️ Output: Flows and/or Alerts
https://t.co/3sqnfOpN4a

[Phill Moore @phillmoore]

Week 18 - 2026 #DFIR
https://t.co/LmkA1nkSzS

[mthcht @mthcht2]

Launching https://t.co/Z3gUh4OCOA
Look up any OAuth app ID and find out what it actually is across thousands of legitimate, risky, and malicious apps (Entra, Google, GitHub).
Multiple feeds, API, detection ideas and remediation guidance. Still improving the detections a bit 🦾