Microsoft relases an updated Windows Defencer on Windows 10

Microsoft has just added Network Threat Protection to their Windows Defender built into Windows 10. http://news.softpedia.com/news/microsoft-launches-windows-defender-advanced-threat-protection-501198.shtml

Follow on Twitter: ITSECSAM

Paper about forenics on Virtual OS running on a Thumbdrive.

Performing Forensics on a Virtual OS on a Thumb Drive can be challenging.  This paper walks through some of the gotchas.

Tracing Forensic Artifacts from USB-Bound Computing Environments on Windows Hosts

Follow on Twitter: ITSECSAM

New Threat Intelligence sharing coming from DHS

DHS has been tasked with sharing their Threat Intelligence with Businesses in an effort to improve cyber_security.

http://www.technewsworld.com/story/DHS-Ready-to-Share-Intelligence-With-Private-Sector-83127.html

Follow on Twitter: ITSECSAM

Exploring Prefetch Files

One of the first things I look at when performing forensics on a system is the prefetch files which gives a report about recently run software on the system. Some malwre now recognize the importance of these files and delete them when they run.

For cases where there is still prefetch files there is a great open source tools to parse them and convert the output to a useable format.

Here is the link:
https://github.com/EricZimmerman/PECmd

Follow on Twitter:ITSECSAM

MALTRAIL - Malware Network Sensor

There is a github project to build a network based malware detection system. This system uses blacklist and other open source information to build up a scoring system for network traffic that indicates the presence of malware.

I have not tested this system yet, however we are in the process of bringing in new equipment which frees up some older equipment to run tests on.

Here is the link:
https://github.com/stamparm/maltrail

Follow on Twitter: ITSECSAM

Analyze Volume Shadow Copies

Back in December, Harlan Carvey posted a blog about the use of tools to analyze Volume Shadow Copies to uncover historic information about the operations of a system.

If malware has been running for a while or the user has been performing activities of interest, then looking at the Volume Shadow Copies can aid in that investigation.

Here is the link:
http://windowsir.blogspot.com/2015/12/working-with-shadow-volumes.html

Follow on Twitter: ITSECSAM

Using Python to mount a Forensics Image

The folks at Hacking Exposed have a good article about using the libraries in SleuthKit to mount image files using Python.

I have not tried this process out but I can image an automates tool which would make use of these libraries.

Here is the link:
Hacking Exposed Computer Forensics Blog: How to install dfVFS on Windows without compiling

Follow on Twitter: ITSECSAM