Did It Execute?
August 27 2013You found a malicious executable! Now you've got a crucial question to answer: did the file execute? We'll discuss a few sources of ...
Read moreHighlighter Super Users Series: Post 2
January 23 2013Back in November I published the first interview from the Highlighter™ Super Users blog series. My goal with this series is to shed some...
Read moreHighlighter Super Users Series: Post 1
November 16 2012The Highlighter™ Super Users series is a little something I've put together to reach out to the Highlighter community. As a...
Read moreIncident Response with NTFS INDX Buffers – Part 4: The Internal Structures of an INDX Attribute
October 16 2012By Jeff Hamm & William Ballenthin On August 30th, 2012, we presented a webinar on how to use INDX buffers to assist in an ...
Read moreIncident Response with NTFS INDX Buffers – Part 3: A Step by Step Guide to Parse INDX
October 10 2012By William Ballenthin & Jeff Hamm Our last post in the Incident Response with NTFS INDX Buffers series detailed the internal...
Read moreIncident Response with NTFS INDX Buffers – Part 2: The Internal Structures of a File Name Attribute
September 26 2012By Jeff Hamm & William Ballenthin Last week on M-Unition, Willi and I published the first post in...
Read moreBy William Ballenthin & Jeff Hamm On August 30, 2012, we presented a webinar on how to use INDX buffers to...
Read more
Recent Comments