Dave

[Andrew Case @attrc]

Thank you to @juanandres_gs for the @Volexity shout out in the latest Three Buddy Problem episode! If you aren't performing memory forensics in your environments, then you cannot make any definitive claims on whether you are compromised!

https://t.co/ONaXbD9HKl

[Andrew Case @attrc]

Memory forensics is a required technique to detect and respond to modern malware. Come see Volcano in action at FIRST next week to learn how memory forensics can be applied at true enterprise scale.

[Volexity @Volexity]

.@Volexity Volcano Server & Volcano One v26.04.27 adds memory analysis for arm64 Windows, memory-only .NET assemblies, SRUM database, Linux systemd units, history & timers from RAM.

This release also adds detection of AppleScript usage, cleared Windows event logs, AV scanning of files & deployments across AWS accounts.

Contact us for more information: https://t.co/hKxUckBWL7

#memoryforensics #memoryanalysis #dfir

[Andrew Case @attrc]

We (@Volexity) are looking to hire for two roles in our rapidly growing software engineering team and ecosystem. The first role is for a Group Product Manager and the second a Senior Product Manager. Both roles will be on-site in Silver Spring, Maryland.

https://t.co/meGMLq3wMo

[Volexity @Volexity]

.@Volexity Volcano Server & Volcano One v25.09.21 adds memory analysis support for ARM64 Linux, macOS 26 (Tahoe) & Windows 25H2, as well as 75+ new YARA rules, 10+ new IOCs, analysis of udev rules, and rolling upgrades for managed endpoints. [1/2]

[volatility @volatility]

We are excited to announce that we are hosting a second training course for #FTSCon week! Join @JoeGrand as he leads his popular 2-day Hardware Hacking Basics course on Oct. 21-22 in Arlington VA!

[Andrew Case @attrc]

Our highly popular and technical training, "Malware and Memory Forensics with Volatility", has been fully converted to @volatility 3 and significantly updated, including many new sections and 8 new, in-depth labs. Available online and in VA in October.

https://t.co/kihCRhwaov

[Dave @superponible]

Exciting news!

[volatility @volatility]

We are very excited to announce that Volatility 3 has reached parity with Volatility 2! With this achievement, Volatility 2 is now deprecated. See the full details in our blog post: https://t.co/Vd8cGVe6ap

[Andrew Case @attrc]

I spoke at @BSidesPhilly last year on how kernel rootkits operate on Windows 10+ systems and how to detect and defend against them. My closing argument was to enable HVCI everywhere possible or it’s hopeless. Full talk is online:

https://t.co/IqeJ3x1kLq

[Volexity @Volexity]

.@Volexity Volcano Server & Volcano One v25.02.21 adds 300 new YARA rules; consistent Bash/ZSH history & sessions from Linux/macOS memory and files; and parses Linux systemd journals, macOS unified logs, and Windows USNs (search + timeline for all).
[1/2]

#dfir #memoryforensics

[Andrew Case @attrc]

Surge Collect Pro provides stable, secure memory and selective file acquisition across all major operating systems and cloud providers. It also supports PGP encrypted collections so only your DFIR team can access collected data.

https://t.co/tJQGmekzlw

#DFIR @Volexity

[Andrew Case @attrc]

PSA to Red Teams: forking/cloning lsass.exe to get creds from the child is a gift to the blue team as it leaves a lsass child process + makes a trivial event log based detection. The following URL is timestamped to where I discussed this at @BSidesPhilly

https://t.co/5TQVYcyiJG

[Andrew Case @attrc]

The first public Malware and Memory Forensics training based exclusively on @volatility 3 will run from Oct 22nd to 25th in Arlington, VA. The class is filling up quickly as we near the registration deadline. Email us ASAP to attend!

https://t.co/9wxD6sdh8s

#DFIR #infsoec

[5ck @5ck]

We're hiring @Volexity! Details can be found at the job posting below 👇

https://t.co/tKI7g089I7

Don't hesitate to reach out with questions!

[Andrew Case @attrc]

In late October, we are hosting our first public Malware & Memory Forensics with Volatility training that is focused exclusively on Volatility 3. This is your chance to learn all the new features and capabilities directly from the developers!

https://t.co/9wxD6sdh8s

#DFIR

[Volexity @Volexity]

There are several opportunities coming up to hear some outstanding talks given by members of @Volexity’s R&D and #threatintel teams! We’ve compiled a list of who and where:
1/8

[Volexity @Volexity]

.@Volexity Volcano Server & Volcano One v24.09.12 adds 320 new YARA rules, IOCs for reverse shells on Linux, support for non-English unicode, and browser history from RAM [1/4]

#dfir #memoryforensics #memoryanalysis

[Andrew Case @attrc]

We have an incredible lineup of speakers confirmed for our From the Source event plus the entire Spy Museum in DC booked out for our networking event at night. You don't want to miss it!

https://t.co/B86jfeGsKt

[volatility @volatility]

The @volatility Foundation is donating 100% of the proceeds for #FTSCon to @ConnectOurKids (https://t.co/Bhad9pFqAy), a 501(c)(3) nonprofit that is pioneering technology to find families, build connections, and create community for children in the foster care system.

[volatility @volatility]

1/ To celebrate the 10th anniversary of The #ArtOfMemoryForensics, we are giving away 1 seat at the upcoming in-person Malware & Memory Forensics Training on #Volatility3 with a pass to From The Source #FTSCon! Just post a pic of your book & tag @volatility!