Blanche

DFIR, Dungeon Master, mini painter, drummer, lover of many things... Except cats. Hate cats.
@moustik01.bsky.social

[Blanche @moustik01]

As promised, amcache analysis v2 is out, you can find it here: https://t.co/DqSy3Ih0BV
Thread for what's new:
#DFIR #DFIRSummit

[Digital Forensic Doctoral Symposium @DFDocSym]

Our program and list of accepted papers is now on the website. We’re looking forward to welcoming everyone to Brno for the symposium on 1st April and a great week at @DFRWS EU.

Link: https://t.co/4WS3yUdQNT

[CERT-FR @CERT_FR]

Le CERT-FR recrute un expert en investigation numérique ! Si vous aimez traquer les APTs, souhaitez devenir expert sur des technologies très variées et donner du sens à votre travail, n'hésitez pas à postuler 🙂
➡ https://t.co/lsyHAmFqr2

[Blanche @moustik01]

#DFIR folks, if you ever used #DFIRORC and got overwhelmed with the output, you'll be glad to know that thanks to orc2timeline, the new tool from @ANSSI_FR, you can now create a timeline directly from your collect! https://t.co/hfrmTQGSva

[CERT-FR @CERT_FR]

Ces derniers mois ont été marqués par plusieurs incidents ciblant des entités du secteur social ayant conduit à l'exfiltration de données personnelles. Le CERT-FR propose un retour d'expérience et des recommandations associées :
https://t.co/qZESP2HkCk

[DFRWS @DFRWS]

You still have 2 weeks to submit your abstract and join us in Brno next year!
Learn more: https://t.co/fGoDblEGEJ
Submit here: https://t.co/eLHT5jBCQr

#dfrws #conference #digitalforensics #eu #CzechRepublic #Brno #cybersecurity #dfir #computerforensics #workshop

[Blanche @moustik01]

It's tomorrow and we're probably gonna change everything on the way in so you know it's gonna be perfect 👌
And if everything fails, we still have stickers 😬 #dfrws

[DFRWS @DFRWS]

In the morning’s hybrid workshop, ANSSI’s Blanche Lagny & Sébastien Chapiron will present “Incident response with #DFIR-ORC,” an open-source collection of tools designed to parse & collect critical artefacts. Register at: https://t.co/G4ggtL05kh

[DFRWS @DFRWS]

In the morning’s hybrid workshop, ANSSI’s Blanche Lagny & Sébastien Chapiron will present “Incident response with #DFIR-ORC,” an open-source collection of tools designed to parse & collect critical artefacts. Register at: https://t.co/G4ggtL05kh

[Blanche @moustik01]

@H_Miser "Cela étant, le travail de déclinaison [d'obligation déontologique] élargi aux civils doit être approfondi car dans un contexte de forte concurrence sur le marché de l’emploi, toute contrainte supplémentaire fait peser un risque sur l’attractivité du ministère." (2/2)

[Blanche @moustik01]

@H_Miser J'ai pas accès à l'article en entier mais si la source c'est ça : https://t.co/Usxar2CvMu
Dans la partie sur les obligations déontologiques qui ne pèsent actuellement que sur les militaires, il est plutôt dit que : (1/2)

[Blanche @moustik01]

The program for @DFRWS is out! I will co-animate a workshop on DFIR-ORC, if you're interested in learning more about the tool 😁
https://t.co/QXAYqxbB40
#DFIR #DFRWSEU2024

[SwiftOnSecurity @SwiftOnSecurity]

A story.

An enterprise data application has been down for a day. 60 people from the company contractors and vendor have been on and off the same 24/7 service bridge call trying to fix it.

They are currently waiting for a restore process and have been for hours.

Then I log in.

[Blanche @moustik01]

@tomchop_ Sacrilège !!!! https://t.co/NFor8zns2J

[Grzegorz Tworek @0gtweet]

Explorer hides extensions of 16 file types, even if you want to see them all. If such files contain real PE (exe) content, they behave differently when you double click them. Nothing, errors, OpenWith dialog, etc.
And one of them will run actual exe file 😈
Dare to guess?

[Grzegorz Tworek @0gtweet]

As a fan of non-obvious persistence mechanisms I had to try to collect (and categorize!) them all. It has just started, first 10 entries appeared, and more is coming each day.
I am happy to share it. Enjoy, contribute, use freely - https://t.co/PWb2ofSZjQ

[Blanche @moustik01]

@CayreRomain Nope, faut un billet imprimé. Et si on a oublié, il y a des personnes à l'accueil pour le faire mais du coup 15-20 minutes de queue selon l'affluence

[Blanche @moustik01]

2022 et il faut encore avoir les badges imprimés pour scanner un QR code... #FIC2022

[Blanche @moustik01]

.@ldap389 with DFIR4vSphere, a powershell module for vSphere forensics : https://t.co/E5tYQ1TNI0
#CoRIIN2022