Using Real-Time Events in Investigations
May 14 2020To understand what a threat actor did on a Windows system, analysts often turn to the tried and true sources of historical endpoint artifacts such as the...
Read moreIn December 2019, we published a blog post on augmenting analysis using Microsoft Excel for various data sets for incident response investigations. As we described,...
Read moreWhen we discover new intrusions, we ask ourselves questions that will help us understand the totality of the activity set. How common is this activity? Is there anything...
Read moreM-Trends 2020: Insights From the Front Lines
February 20 2020Today we release M-Trends 2020, the 11th edition of our popular annual FireEye Mandiant report. This latest M-Trends contains all of the...
Read moreThe Missing LNK — Correlating User Search LNK files
February 19 2020Forensic investigators use LNK shortcut files to recover metadata about recently accessed files, including files deleted after the time of access. In a recent investigation, FireEye Mandiant...
Read more404 Exploit Not Found: Vigilante Deploying Mitigation for Citrix NetScaler Vulnerability While Maintaining Backdoor
January 16 2020As noted in Rough Patch: I Promise It'll Be 200 OK, our FireEye Mandiant Incident Response team has been hard at work responding to intrusions ...
Read moreIncident response investigations don’t always involve standard host-based artifacts with fully developed parsing and analysis tools. At FireEye Mandiant, we frequently encounter incidents that involve a ...
Read moreAttackers often make their lives easier by relying on pre-existing operating system and third party applications in an enterprise environment. Leveraging these applications assists them with blending ...
Read moreM-Trends 2018
April 4 2018What have incident responders observed and learned from cyber attacks in 2017? Just as in prior years, we have continued to see the cyber security threat landscape...
Read moreCitrix XenApp and XenDesktop Hardening Guidance
March 15 2016A Joint Whitepaper from Mandiant and Citrix Throughout the course of Mandiant’s Red Team and Incident Response engagements, we frequently identify a wide array of ...
Read more
Recent Comments