Making the most of Property Lists
Property Lists are files that store important data/metadata about a user and its device. They are found in iOS/MacOS and are important in the scope of DFIR investigations.
Latest
CyberDefenders: Hafinum-APT
Windows Event Logs Analysis Challenge, and I am happy to introduce my rebrand of my old script to make a sqlite database out of Windows Event Logs!!!
PwnMe Quals 2023: Crypto
My writeups for the Cryptography challenges of the 2023 PWNme Qualifications.
Cryptoverse CTF 2023: Crypto
My writeups for the Cryptography challenges of the 2023 Cryptoverse CTF!
Windows Forensics
CyberDefenders: Hafinum-APT
Windows Event Logs Analysis Challenge, and I am happy to introduce my rebrand of my old script to make a sqlite database out of Windows Event Logs!!!
HackTheBox: Insider
A potential insider threat has been reported, and we need to find out what they accessed. Can you help?
HackTheBox: Event Horizon
Our CEO’s computer was compromised in a phishing attack. The attackers took care to clear the PowerShell logs, so we don’t know what they executed. Can you help us?
CyberDefenders: Pwned-DC
An ActiveDirectory compromise case: adversaries were able to take over corporate domain controller. Investigate the case and reveal the Who, When, What, Where, Why, and How.
TryHackMe: Investigating Windows
This is a challenge that is exactly what is says on the tin, there are a few challenges around investigating a windows machine that has been previously compromised.
Connect to the machine using RDP. The credentials the machine are as follows:
CyberDefenders: DetectLog4j
For the last week, log4shell vulnerability has been gaining much attention not for its ability to execute arbitrary commands on the vulnerable system but for the wide range of products that depend on the log4j library. Many of them are not known till now. We created a challenge to test your ability to detect, analyze, mitigate and patch products vulnerable to log4shell.
CyberDefenders: Injector
A company’s web server has been breached through their website. Our team arrived just in time to take a forensic image of the running system and its memory for further analysis. As a security analyst, you are tasked with mounting the image to determine how the system was compromised and the actions/commands the attacker executed.
Follow Us
Video of the Week
TAGS
Cheatsheets
Mac & iOS Forensics Cheatsheet & Tools
This is a list of tools/cheatsheet for all things MacOS and iOS.
Windows Forensics Cheatsheet & Tools
Wine Wine is great as you can run Windows apps on any linux distributions. sudo apt update && sudo apt upgrade -y sudo apt-get install
Memory Analysis Cheatsheet & Tools
Analysis Volatility2 Volatility is the go to for memory analysis. There are two versions: Volatility for Python 2 and Volatility3 for Python3. They are quite