makhno

Security enthusiast, old papy CTF player and eternal n00b for @Beers4Flags, #forensic & #DFIR addict. I like pcap, logs and dump memory analysis

[L'Humanité @humanite_fr]

Aujourd'hui, nous vous avons révélé le projet confidentiel à « 150 millions d’euros » du milliardaire Pierre-Edouard Stérin pour faire gagner le RN. Notre journaliste @Thomas_Lemahieu vous explique le dossier.

Nos révélations ➡️ https://t.co/OHs5H82YVk

[Olivier Tesquet @oliviertesquet]

En novembre dernier, @Disclose_ngo révélait l’utilisation illégale d’un logiciel de reconnaissance faciale par la police. Darmanin promettait une enquête indépendante et des conclusions rendues publiques sous trois mois. Depuis, c’est silence radio.

https://t.co/WOguakhVlg

[Phill Moore @phillmoore]

Week 13 - 2024 #DFIR
https://t.co/rDJKAZP5AU

[makhno @m4khno_]

#FIC2024
Très belle présentation de l'outil #Volweb par @k1nd0ne au #Coriin
#forensic, #volatility,#memory

[k1nd0ne @k1nd0ne]

Exciting news: VolWeb 2.0 is out! This digital forensics memory analysis platform leverages the capabilities of @volatility 3 framework. With significant enhancements, it now offers improved flexibility and scalability! https://t.co/CC54A8d1gm.

1/8

[Mayfly @M4yFly]

New lab 🏰 for the GOAD project 🥳: SCCM
You can now test the SCCM/MECM attacks locally on Virtualbox or Vmware.

More information here:
https://t.co/BvAZgLSHQr

Repository here : https://t.co/mi3rP9hC1H

Thx again @KenjiEndo15 for your help to building this !

[HackGit @hack_git]

forensictools

A toolkit designed for digital #forensics, offering a wide array of tools. Its primary goal is to simplify the creation of a virtual environment for conducting forensic examinations.

https://t.co/pZ89qFic1v

#cybersecurity #infosec

[Clandestine @akaclandestine]

#tools
#Blue_Team_Techniques
1. Sigma rules for Linux and MacOS
https://t.co/Jfrh8mfwOk
2. The multi-platform memory acquisition tool
]-> Win7-10: https://t.co/TyNJmiXcMU
]-> Linux x64: https://t.co/lOVBsycgww

[Root-Me @rootme_org]

For Christmas 2023, Root-Me has decided to thank its favorite hackers! 🥳
Two prize packages including XXL mouse pads, mugs, stickers, flags, and pins are up for grabs ! 🎁

To participate, it's as simple as :

- Follow @rootme_org
- RT 🔃 this post
- Being verified on the official Discord Root-Me

The two winners will be randomly selected on December 28th at 6 p.m. !
Good luck to everyone and happy holidays ! 🎅🤶

[k1nd0ne @k1nd0ne]

Analysis of the Import Address Table of a process in memory can be useful when performing Digital Forensic and Reverse Malware Engineering.

Here is a @volatility 3 plugin to extract the IAT.

Merry Christmas!

Blog Post : https://t.co/ZIsJkGKHqq

[Phill Moore @phillmoore]

Week 49 - 2023 #DFIR
https://t.co/yrVYgaTyZ0

[k1nd0ne @k1nd0ne]

MFT records and therefore alternate data streams (ADS) can be carved from a memory image.
Here is a @volatility 3 plugin added to mftscan in order to extract ADS:

Look for downloaded files via Zone.Identifier and potential malicious code!

Blog Post : https://t.co/ngA3XWbE8c

[k1nd0ne @k1nd0ne]

Time to make @volatility 3 compatible with modern Windows hibernation file analysis.
Blog post : https://t.co/csNyxyZqO5
Feature : https://t.co/9UjMtS4TVp

Special thanks to @chadtilbury who gave me the motivation and @jtsylve, @vicomarziale, @nolaforensix for the incredible work

[Mattia Epifani @mattiaep]

iOS 15 Image Forensics Analysis and Tools Comparison - Native Apps

https://t.co/f347cvHwAf

#DFIR #mobileforensics

[Phill Moore @phillmoore]

Week 44 - 2023 #DFIR
https://t.co/tN1nkUOxyX

[makhno @m4khno_]

My last #forensic chall
@Glacius_ , @maki_mitz , @iansus & co are you amateur enough to test and succeed ?😇😋😘

[Root-Me @rootme_org]

Our contributors have struck again!! 5 new Forensic challenges are now available on the #RootMe and Root-Me Pro environments:https://t.co/6FDj67GAxd

Many thanks to the authors: #Yorf, @Zey_Roxx , @m4khno_ , #Dridri 👏 !
Enjoy !

[Mari Degrazia @maridegrazia]

I have a new blog post up detailing per app registry hives for analysis in #DFIR investigations related to MSIX Registry Redirection. These hives can contain additional information that may not be found in other locations. @ZeroFox @sansforensics https://t.co/re9KDpz63g

[Cat @catdfc]

As part of the research my colleagues and I presented at #DFIREurope23 🇨🇿 (https://t.co/4HQdF8iWvr), I updated Chainsaw. It is now capable of analysing SRUM databases and providing new forensic insights 💡(see https://t.co/WGiKSmxepo)
#chainsaw #dfir #SRUM #WithSecure #SANS

[Phill Moore @phillmoore]

Week 41 - 2023 #DFIR

https://t.co/XFbewLoGkB

[volatility @volatility]

.@volatility New Release: #volatility3 v2.5.0 - visit https://t.co/KhWIzDVkP8 for details and downloads.

#memoryforensics #dfir