Articles & Presentations

▼
Tuesday, August 6, 2019

The Windows Registry Auditing Cheat Sheet update! Aug 2019, v2.5

›
The Windows Registry Auditing Cheat Sheet has been updated to include a few new items to monitor for malicious activity. Keep in mind ...
Thursday, July 12, 2018

Come learn how to hunt on Windows quickly - SANS Threat Hunting & IR Summit

›
I am giving a talk at the SANS Threat Hunting & IR Summit in New Orleans Sept 6th & 7th.  You Can get more information here: ...
Saturday, April 21, 2018

Sample WinLogBeat.yml file for ELK and Humio users

›
We have published a sample WinLogBeat.yml file for ELK and Humio users to collect the right stuff and provide an example of how to exclude ...
Saturday, March 10, 2018

New Incident Response Podcast

›
I have joined Brian Boettcher and started the " Brakeing Down Incident Response " podcast expanding the " Brakeing Down Secu...
Monday, October 23, 2017

Looking at APT28 latest Talos Security write up and how YOU could catch this type of behavior

›
The Cisco Talos Team just published a report on the latest APT28 malware that came in as a deceptive "Cyber Conflict U.S. Conferenc...
Thursday, September 28, 2017

Microsoft is breaking our security improvements with the new Windows 10 cumulative updates/upgrades

›
Windows 10 has been touted as a more secure Windows.  With Windows 10, Microsoft has changed the way systems are patched.  No more ‘Patc...
Monday, May 1, 2017

Fileless Malware? Not so fast, let's consider new terms

›
There is a lot of discussion lately about 'fileless malware', also referred to as 'living off the land', 'memory o...
Monday, October 24, 2016

The Windows Logging, File and Registry Auditing Cheat Sheets updated for Windows 10 and some cleanup and additions

›
The 'Windows Logging Cheat Sheet', 'Windows File Auditing Cheat Sheet' and 'Registry Auditing Cheat Sheet' have...
Thursday, September 15, 2016

Avoiding Ransomware with built in basic changes

›
Ransomware is a pain for those that have been unfortunate to get infected or had to respond to a ransomware event.  While presentin...
Monday, August 1, 2016

LOG-MD Selected For Blackhat Arsenal Based On The 'Windows Logging Cheat Sheet'

›
Come on by Blackhat Arsenal Thursday and check out LOG-MD in action with the latest version on how to check, set, and harvest malwar...
Thursday, June 16, 2016

The Windows PowerShell Cheat Sheet is now available!

›
We are proud to announce the release of the " Windows PowerShell Logging Cheat Sheet ".  This latest cheat sheet is focused at ...
Saturday, May 7, 2016

Windows Top 10 Events to monitor from My Dell Enterprise Security Summit Talk

›
Here is my presentation from the talk I gave at the Dell Enterprise Security Summit in Atlanta April 21, 2016. SlideShare Presentation...
Tuesday, March 29, 2016

PowerShell RansomeWare via Word Docs starting to rear its ugly head - completely detecable

›
Carbon Black last week released a report that PowerShell is being used in RansomWare attacks.  Why is this important?  By using PowerS...
Wednesday, February 17, 2016

Detecting port scans between hosts on the same segment, could you detect this? Windows could help

›
Thanks to one of my fellow InfoSec brethren and fellow security product developer, he got me thinking as to how to detect a situation...