Abusing Linux fanotify for Anti-Forensics Executive SummaryA suspicious file does not have to be hidden to evade inspection.... 2026-11-1 22:16:32 | 阅读: 25 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch fanotify fan perm deny acquisition

Modern Authentication, Legacy Problems IntroductionDuring a recent incident response investigation, we encountered an int... 2026-11-1 22:16:31 | 阅读: 21 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch exchange microsoft entra owa

Field Notes: Reconstructing an Attacker’s Workflow IntroductionDuring a recent incident, we recovered several PowerShell scripts the... 2026-10-24 08:3:52 | 阅读: 25 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch powershell attacker denied windows remote

BalCCon2k26: Deconstructing Modern macOS Initial Access Vectors AbstractFor years, a persistent myth suggested that macOS was inherently immune t... 2026-10-14 20:4:38 | 阅读: 17 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch applescript platypus weaponize defenses attacker

BSides Tallinn: Deconstructing Modern macOS Initial Access Vectors AbstractFor years, a persistent myth suggested that macOS was inherently immune t... 2026-10-14 20:4:37 | 阅读: 18 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch applescript malicious immune youtube lowering

Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow IntroductionThe investigation began with a Microsoft Defender for Endpoint alert f... 2026-10-14 20:4:35 | 阅读: 20 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch intune malicious repository software github

Today I learned: Python's .start Files as a Persistence Mechanism IntroductionPython 3.15 (the final release is currently scheduled for October 9, 2... 2026-10-6 13:18:59 | 阅读: 28 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch python interpreter pth python3 python315

Field Notes: Reconstructing the Attacker's LSASS Dump One of the things I find fascinating is how much effort attackers sometimes put int... 2026-10-1 12:49:7 | 阅读: 19 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch memory trickdump minidump 1979 malmoeb

dfir.ch During a recent incident response engagement, we responded to a single-host infecti... 2026-9-24 16:31:22 | 阅读: 20 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch malicious chainscript attackers ttps infections

The .zshrc.zwc You Forgot to Check IntroductionShell startup files are well-known macOS persistence locations. In a r... 2026-9-24 16:31:21 | 阅读: 34 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch zwc zsh zshrc dfir wordcode

Living Inside the Shell: zsh Modules on macOS IntroductionWhen investigating shell-based activity on macOS, it is tempting to fo... 2026-9-16 19:16:30 | 阅读: 35 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch zsh xattr ztcp dfir telemetry

BSides Munich: Fantastic clear-text passwords and where to collect them 2026-9-13 20:5:49 | 阅读: 25 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch youtube passwords zrpjjakxjp4 mar bsides

BSides Frankfurt: Deconstructing Modern macOS Initial Access Vectors AbstractFor years, a persistent myth suggested that macOS was inherently immune t... 2026-9-13 20:5:47 | 阅读: 26 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch applescript analysis attendees packaged hunt

Field Notes: From AV Alert to Impacket Table of Contents... 2026-9-13 20:5:46 | 阅读: 39 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch defender windows mft artefact secretsdump

Fantastic clear-text passwords and where to collect them (Part 2 - Windows) 1. IntroductionThis post is an expansion of a talk I recently gave about moving be... 2026-6-30 06:26:11 | 阅读: 63 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch passwords windows security cleartext lsa

Fantastic clear-text passwords and where to collect them (Part 1 - Linux) 1. IntroductionDuring Digital Forensics and Incident Response (DFIR) investigation... 2026-6-22 09:9:14 | 阅读: 78 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch pam passwords sshd attacker

| dfir.ch [X] A (Short) History of Linux RootkitsEarly rootkits were designed primarily to h... 2026-6-16 06:40:57 | 阅读: 56 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch github rootkits ebpf readdir memory

FIRST Technical Colloquium Paris: Inside Mythic: Dissecting a Modern Attack Framework AbstractYour mission if you choose to accept it: take on the role of a detection... 2026-6-16 06:40:56 | 阅读: 63 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch agents mythic dissect paris

Botconf: Tomb Raider - In Search of the Lost Signatures AbstractWe explored a decade of open-source offensive tools used in operations wo... 2026-6-16 06:40:54 | 阅读: 48 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch youtube rats living repurposed

Brucon: Anti-Forensics (and Anti-Anti-Forensics) Techniques AbstractA full-spectrum dive into anti-forensics across Windows and Linux (with a... 2026-6-16 06:40:53 | 阅读: 44 | 收藏 | Over Security - Cybersecurity news aggregator - dfir.ch attacker artifacts walks etw vhdx