- Reverse-Engineering a FitRx EMS App into a Python Controller
- Spoke: Seeing the Relationships in Your CSVs
- What ChatGPT Wrote When I Asked It to Blog
- Kernel-Level Access with Live Response
- Running Arbitrary Commands with Live Response
- Using the API for Live Response
- Building a Quick Defender for Endpoint API Wrapper
- Multifactor Access to the Defender for Endpoint API
- BotTricker: Decoding TrickBot Modules
- Decoding AutoIt XOR Obfuscation
- Going from Zero to Hero with CyberChef
- Analyzing the Fiesta Exploit Kit
- Hacking BRBBot
- Setting Up ELK on a MacBook (Part 2)
- Setting Up ELK on a MacBook (Part 1)
- Dealing with Users Gone Bad
- The Grep Before Christmas
- UnXORing a RAT
- Mastering Python Forensics: A Review
- What Windows Defender Does When It Quarantines Stuff
- Parsing Chrome Artifacts with Python (Part 3)
- Parsing Chrome Artifacts with Python (Part 2)
- Parsing Chrome Artifacts with Python (Part 1)
- Finally Parsing WebCacheV01.dat
- Encrypting Huge Memory Files with Python
- Dridex Malware (Part 2): The Payload
- Dridex Malware (Part 1): The Dropper
- WMIC Commands That Aren't Yo Momma's
- The 34 File Entries on a Brand New $MFT
- Evidence of a USB Transfer Cable
- Useless Trivia About Windows Process IDs
- Mass Undeleting from the Recycle Bin
- A Few SysmonMaps for Reference
- A Magic Trick in the Windows 10 Boot Process
- Sysmon 2.0 (Part 2): Filtering Rules
- Sysmon 2.0 (Part 1): The New Events
- Stupid VBS Tricks
- Misadventures in Parsing WebCacheV01.dat (Part 3)
- Misadventures in Parsing WebCacheV01.dat (Part 2)
- Misadventures in Parsing WebCacheV01.dat (Part 1)
- Recovering Zip Files with Python zlib
- The Zip Seeking Missile
- The Anatomy of a Zip File
- Pulling Internet Headers from Outlook with PowerShell
- Reading E-mail with PowerShell
- Querying Sysmon for Execution Times
- Least Frequency of Occurrence with PowerShell
- Live Process Mapping with WMI
- Finally Using GitHub
- More SysmonMaps and a Security Log ProcessMapper
- Sysmon and Mapping Process Creation
- Useful TShark Commands
- War Driving with a Raspberry Pi
- Sharpening the ACKs
