Digital Forensics and Incident Response

AddThis

Showing posts with label DFIR. Show all posts
Showing posts with label DFIR. Show all posts
Tuesday, March 14, 2017

Detecting an Attacker Dumping Passwords from the Windows Registry

›
Several tools are available to dump password hashes from the Windows registry such as Mimikatz and gsecdump. Attackers commonly dump domain ...
Monday, March 13, 2017

Detecting an Attacker Dumping Passwords from Memory

›
Mimikatz ( https://github.com/gentilkiwi/mimikatz ) is a popular tool used by adversaries (and Red Teamers) to dump passwords from memory. P...
Saturday, September 10, 2016

Mounting a BitLocker Encrypted Image Using Dislocker

›
Sometimes it is necessary to boot a host into an alternate OS to acquire a raw disk image. If you need to mount the image for forensic analy...
Home
View web version
David French
Incident Responder interested in Digital Forensics and Malware Analysis.
View my complete profile
Powered by Blogger.