Krisna Sirait·23h agoI Carved 6 Generations of a Canon SD Card (nps-2009-canon2 [digitalcorpora]) .Six forensic images, dozens of deleted photos, and one important lesson about why file carving doesn’t always work.
Khoi Duong·2d agoReconstructing Enterprise Breaches in Google SecOpsHow I achieved a 100% clear (18/18) in Google Cloud Security × Hack The Box’s premier enterprise threat-hunting competition — Operation…
wh0arey0u·2d ago由Azure Sentinel+Logic App+AI砌一套自動化 SOC Playbook — 第二篇: phishing email response playbook上一篇我哋講完成個架構,由 Sentinel、Logic App、Defender API 到 Managed Identity 嘅關係,同埋 Standard vs Consumption tier 點揀。今篇我哋落手砌 — 由零開始寫一個真係 work 嘅 phishing…
Redd Francisco·2d agoGhost Persistence: Uncovering WMI Permanent Event SubscriptionsWhen Run keys, Scheduled Tasks, and Startup folders come back clean, check WMI permanent event subscriptions (root\subscription and…
Devansh Jaiswal·3d agoDFIR Labs: “2-Layer Security” Writeup — Peeling Back a PowerShell Encryptor and a GPG WrapperSuggested Medium subtitle: How a hacker’s own shell history, an obfuscated PowerShell one-liner, and a forgotten GPG keyring gave up a…
Pongsathorn Parivutthipong·3d agoIvanti Connect Secure (CVE-2026-104935 / CVE-2026-111357 / CVE-2026-118527) — Lab Verification & IR…Author: Pongsathorn Parivutthipong · Date: 2026-11-01 (UTC+7) · Scope: defensive inventory / hunt / recovery verification on an isolated…
Pongsathorn Parivutthipong·3d agoAhsayCBS (CVE-2026–105133 / CVE-2026–105134) — Lab Verification & IR NoteAuthor: Pongsathorn Parivutthipong · Date: 2026–11–01 (UTC+7) · Scope: defensive inventory / hunt / mitigation verification on an isolated…
Pongsathorn Parivutthipong·4d agophp2shell (CVE-2026–109618 / CVE-2026–109619) — Lab Verification & IR NoteAuthor: Pongsathorn Parivutthipong · Date: 2026–11–01 (UTC+7) · Scope: defensive patch/mitigation verification on an isolated lab host. No…