Nathan McNulty

nathanmcnulty.com

24 November 2024 10:17

Torn on sharing this, but I think it's important everyone be aware The Office 365 Management Activity API is awesome, but it's also an incredible persistence location to monitor a victim that is almost invisible once set up Let me explain how it works and what to look for ;)

Taz Wake

tazwake.bsky.social

20 November 2024 22:06

In #FOR577 today, we are talking about issues trying to read auditd logs when you dont have access to good tools. Although there is no one-size-fits-all solution, I've found that deploying an Elastic docker container and ingesting data really speeds things up. www.linkedin.com/pulse/linux-...

Jessica Hyde

b1n2h3x.bsky.social

14 November 2024 23:29

#DFIR 💭 of the Day: We need more practitioner created blogs to undergo Peer Review. Check out dfir.pubpub.org to help with that. While the process isn’t as fast as I would like it (we could use more reviewers and volunteers to help with publication)