Security Research & Threat Intelligence
In-depth analysis of threats, hands-on lab testing, detection engineering, and security tooling — by a practitioner, for practitioners.
A deep dive into the critical distinction between Account Logon (authentication) and Logon (resource access) events in Windows Security logs, covering essential Event IDs for Kerberos, NTLM, RDP sessions, and detecting potential compromises.
Volatile memory captures reveal critical artifacts including active processes, network connections, cached credentials, and hidden malware that are essential for thorough incident response investigations.
An introduction to analyzing memory dumps using the Volatility Memory Forensics Framework, including platform support and compatible dump formats for Windows forensic investigations.
A deep dive into the binary XML format used by modern Windows Event Logging, covering the .evtx file structure, storage locations, remote collection architecture, and the common fields analysts encounter in every Event ID.
Memory acquisition involves preserving volatile RAM contents to non-volatile storage for forensic analysis. Success depends on careful execution to prevent corruption and data loss from background processes or system reboots.
An introduction to memory forensics as an emerging discipline within digital forensics, exploring how investigators recover and analyze volatile memory evidence to uncover critical artifacts.
Understanding the critical role of Windows event logs in DFIR work and why proper logging configuration is no longer optional in modern enterprise environments.
Subscribe to receive curated threat intelligence briefings — CVEs, malware trends, and MITRE ATT&CK insights delivered straight to your inbox.
Analyze phishing emails, enrich IOCs, and scan for exposure — from your terminal or REST API.
$ brew install dfir-lab/tap/dfir-cliFree tier · No credit card required
Get threat intelligence briefings delivered to your inbox.
Subscribe to Briefings