teddy_ROxPin

Incident Response | @TheDFIRReport Analyst | Eat, Sleep, and Breathe Infosec

[teddy_ROxPin @RoxpinTeddy]

@iSecRoOt1 @bunsofwrath12 @SecurityAura @_JohnHammond 👍 I tried to create an RECmd target as well but couldn’t figure out how to just grab the key name and not the values. The urls are the keys themselves.

[teddy_ROxPin @RoxpinTeddy]

@bunsofwrath12 @iSecRoOt1 @SecurityAura @_JohnHammond Looked to be it but not quite.

[teddy_ROxPin @RoxpinTeddy]

@bunsofwrath12 @iSecRoOt1 @SecurityAura @_JohnHammond Looks like the keypath is being enumerated in ‘Cloud Storage -> OneDrive’ in the Kroll batch file

[teddy_ROxPin @RoxpinTeddy]

@fjaviercn @TheDFIRReport @Kostastsale 'trend8.bat'

[teddy_ROxPin @RoxpinTeddy]

@fjaviercn @TheDFIRReport @Kostastsale 'trend.bat'

[teddy_ROxPin @RoxpinTeddy]

@sans_isc I created a simple PowerShell function that retrieves Alternate Data Stream information pertaining to when and from where a file was downloaded. https://t.co/3FqgX18CQd