Top Tweets for #DFIRTip

over 4 years ago

05 Windows Registry - EventLogs | Digital Forensics & Incident Response الحلقة الخامسة من سلسلة التحقيق الجنائى الرقمى و الاستجابة للحوادث باللغة العربية. https://t.co/9HcCJbrzis Slides: https://t.co/Yo8wNWhOw5 #DFIR #dfirtip #امن_المعلومات

0xHasanM's tweet photo. 05 Windows Registry - EventLogs | Digital Forensics & Incident Response

الحلقة الخامسة من سلسلة التحقيق الجنائى الرقمى و الاستجابة للحوادث باللغة العربية.
https://t.co/9HcCJbrzis
Slides: https://t.co/Yo8wNWhOw5

#DFIR #dfirtip #امن_المعلومات https://t.co/mBjXMDvsFC

1

244

29

64

0

over 4 years ago

A new update was released for Autopsy-RegistryExplorer-plugin. As suggested by @EricRZimmerman , The plugin now supports the analysis of transaction logs thanks to Mr. Eric's tool 'rla.exe' https://t.co/GXTTN0Z05y #dfirtip #dfir #cybersecuritytips

0xHasanM's tweet photo. A new update was released for Autopsy-RegistryExplorer-plugin. As suggested by @EricRZimmerman , The plugin now supports the analysis of transaction logs thanks to Mr. Eric's tool 'rla.exe'

https://t.co/GXTTN0Z05y

#dfirtip #dfir #cybersecuritytips https://t.co/wAoakRVTUj

0

44

11

7

0

over 4 years ago

RegistryExplorer: @sleuthkit autopsy module to analyze Registry Hives based on @EricRZimmerman RegistryExplorer's bookmarks https://t.co/GXTTN0Z05y Features: 1. Analyze registry hives without loading a full disk image 2. Keys Categorization #dfirtip #dfirtips #cybersecurity

0xHasanM's tweet photo. RegistryExplorer: @sleuthkit autopsy module to analyze Registry Hives based on @EricRZimmerman RegistryExplorer's bookmarks

https://t.co/GXTTN0Z05y

Features:
1. Analyze registry hives without loading a full disk image
2. Keys Categorization
#dfirtip #dfirtips #cybersecurity https://t.co/lhvhPooVI4

1

16

11

6

0

over 4 years ago

04 Windows Registry - DFIR | Digital Forensics & Incident Response الحلقة الرابعة من سلسلة التحقيق الجنائى الرقمى و الاستجابة للحوادث باللغة العربية. https://t.co/xT67Z5KbxO #DFIR #dfirtip #امن_المعلومات

0

93

15

29

0

over 4 years ago

#dfirtip #dfir I can't stress enough the value of System Event ID 7045 when a new service is installed. A common TTP in ransomware & cobalt strike cases. /1

r3nzsec's tweet photo. #dfirtip #dfir

I can't stress enough the value of System Event ID 7045 when a new service is installed. A common TTP in ransomware & cobalt strike cases.

/1 https://t.co/bfXQZK5Shl

10

659

137

159

0

over 4 years ago

#dfirtip #blueteamtips A friend of mine @yamatosecurity introduced to me his new swiss army knife tool to help us #dfir folks in investigating windows event logs. It was written in PowerShell and can provide tons of stuff + sigma rules integration! https://t.co/omIDQRJECV

0

9

6

4

0

almost 5 years ago

Curious about how #ransomware operators get their overall profit and other shenanigans in the RaaS platform? This research from @NCCGroupInfosec nailed it! https://t.co/RVIkfQVeAy #dfir #incidentresponse #infosec #dfirtip

r3nzsec's tweet photo. Curious about how #ransomware operators get their overall profit and other shenanigans in the RaaS platform? This research from @NCCGroupInfosec nailed it! https://t.co/RVIkfQVeAy

#dfir #incidentresponse #infosec #dfirtip https://t.co/RTAy02yMgc

0

28

11

6

0

almost 5 years ago

8\ anything to add on this thread full of amazing tools? Let me know #dfirtip #infosec

2

5

0

almost 6 years ago

#DFIRtip Kyms is one of the vault apps that allows users to hide and encrypt files, documents and passwords. With Oxygen Forensic Detective investigators can fully decrypt data hidden in the most popular vault apps. #DFIR

oxygenforensic's tweet photo. #DFIRtip Kyms is one of the vault apps that allows users to hide and encrypt files, documents and passwords. With Oxygen Forensic Detective investigators can fully decrypt data hidden in the most popular vault apps. #DFIR https://t.co/3RIry2kQCc

0

4

1

0

almost 6 years ago

#DFIRtip Did you know that Oxygen Forensic Detective allows you to make screenshots of Android device data with the OxyAgent utility? Screenshots can be later viewed in the Files section of the software. #DFIR

oxygenforensic's tweet photo. #DFIRtip Did you know that Oxygen Forensic Detective allows you to make screenshots of Android device data with the OxyAgent utility? Screenshots can be later viewed in the Files section of the software. #DFIR https://t.co/rywx5Mdptq

0

6

4

0

almost 6 years ago

#DFIRtip Need to analyze the Application activity in an Android device? Once the Android device data is extracted, go to the OS Artifacts section and track the history of app launches. #DFIR

oxygenforensic's tweet photo. #DFIRtip Need to analyze the Application activity in an Android device? Once the Android device data is extracted, go to the OS Artifacts section and track the history of app launches. #DFIR https://t.co/wBkoMBmYBH

0

1

0

almost 6 years ago

#DFIRtip Need to view a location with a different time zone setting on Oxygen Forensic Maps? We have you covered. Set the desired time zone in the Options menu. #DFIR #saferworld

oxygenforensic's tweet photo. #DFIRtip Need to view a location with a different time zone setting on Oxygen Forensic Maps? We have you covered. Set the desired time zone in the Options menu. #DFIR #saferworld https://t.co/iEuA8aFq2U

0

2

1

0

almost 6 years ago

#DFIRtip Did you know that the latest Oxygen Forensic Detective can identify words in images and convert them into machine-coded text? Investigators no longer need to waste time manually transcribing texts! #DFIR

oxygenforensic's tweet photo. #DFIRtip Did you know that the latest Oxygen Forensic Detective can identify words in images and convert them into machine-coded text? Investigators no longer need to waste time manually transcribing texts! #DFIR https://t.co/yB8CU2mQrm

0

2

0

about 6 years ago

#DFIRtip Did you know that Oxygen Forensic Detective can import and parse over 35 types of backups and images: GrayKey extractions, DAR archives, JTAG images, drone flight logs and images, iTunes, Huawei and Xiaomi backups, Warrant Returns and many others? #DFIR #saferworld

oxygenforensic's tweet photo. #DFIRtip Did you know that Oxygen Forensic Detective can import and parse over 35 types of backups and images: GrayKey extractions, DAR archives, JTAG images, drone flight logs and images, iTunes, Huawei and Xiaomi backups, Warrant Returns and many others? #DFIR #saferworld https://t.co/nSzkRl4dqN

1

3

0

about 6 years ago

#DFIRtip Kyms is one of the vault apps that allows users to hide and encrypt files, documents and passwords. With Oxygen Forensic Detective investigators can fully decrypt data hidden in the most popular vault apps. #DFIR

0

4

3

0

about 6 years ago

#DFIRtip Did you know that Oxygen Forensic Detective 12.6 allows you to do both full file system extraction via #checkm8 vulnerability and logical extraction of Apple iOS devices with the latest iOS version 13.7? #DFIR

oxygenforensic's tweet photo. #DFIRtip Did you know that Oxygen Forensic Detective 12.6 allows you to do both full file system extraction via #checkm8 vulnerability and logical extraction of Apple iOS devices with the latest iOS version 13.7? #DFIR https://t.co/GjMM1aq9ND

1

2

1

0