corpus.blog
41554 blogs · [ { "id": "01a0876c-4748-7199-8bfd-e8406b060f69", "title": "CLRaptor: Hunting reflected assemblies with Velociraptor", "url": "https://dfir.au/posts/2025/clraptor_hunting_for_assemblies/", "published_at": "2025-12-01T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e8406bfbf9f4", "title": "MCP Velociraptor", "url": "https://dfir.au/projects/mcp-velociraptor/", "published_at": "2025-04-15T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e8406ce5729e", "title": "Finding the LNK: Techniques and methodology for advanced analysis", "url": "https://dfir.au/posts/2024/finding_the_lnk/", "published_at": "2024-11-01T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e8406d1f2a52", "title": "How To Hunt For UEFI Malware", "url": "https://dfir.au/posts/2024/uefi/", "published_at": "2024-02-29T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e8406e06bc79", "title": "DEATHcon2023: Practical DEATH by Velociraptor", "url": "https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/", "published_at": "2023-11-20T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e8406e60c9e8", "title": "Content Management Like a Boss!", "url": "https://dfir.au/projects/content-management-like-a-boss/", "published_at": "2023-09-13T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e8406ec3d6f5", "title": "Automating Qakbot decode at scale", "url": "https://dfir.au/posts/2023/qakbot/", "published_at": "2023-04-05T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e8406f831030", "title": "Detectraptor", "url": "https://dfir.au/projects/detectraptor/", "published_at": "2022-11-17T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e8406fefd40d", "title": "DEATHcon 2022 Velociraptor workshop", "url": "https://dfir.au/projects/deathcon-2022-velociraptor-workshop/", "published_at": "2022-11-05T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e84070323338", "title": "Notebook and VQL - data munging your way to victory!", "url": "https://dfir.au/projects/notebook-and-vql-data-munging-your-way-to-victory/", "published_at": "2022-09-17T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e840705f2490", "title": "WMI Event Consumers: what are you missing?", "url": "https://dfir.au/posts/2022/wmi-eventing/", "published_at": "2022-01-12T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e84070e0366e", "title": "Cobalt Strike Payload Discovery And Data Manipulation In VQL", "url": "https://dfir.au/posts/2021/cobaltstrike_vql/", "published_at": "2021-11-09T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e84070fbaaec", "title": "Windows IPSEC for endpoint quarantine", "url": "https://dfir.au/posts/2020/ipsec/", "published_at": "2020-07-23T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e84071cc4aa5", "title": "Local Live Response with Velociraptor ++", "url": "https://dfir.au/posts/2019/local_liveresponse_with_vr/", "published_at": "2019-12-08T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e84072c75659", "title": "Live response automation with Velociraptor", "url": "https://dfir.au/posts/2019/liveresponse_with_vr/", "published_at": "2019-11-10T00:00:00+00:00" }, { "id": "01a0876c-4748-7199-8bfd-e84072c85b8c", "title": "Endpoint Hunting in an AntiEDR World", "url": "https://dfir.au/projects/endpoint-hunting-in-an-antiedr-world/", "published_at": "2019-06-26T00:00:00+00:00" }, { "id": "01a0876c-4749-70a9-9b62-1c1fd9f41eaa", "title": "O365: Hidden InboxRules", "url": "https://dfir.au/posts/2019/o365_hiddenrules/", "published_at": "2019-06-09T00:00:00+00:00" }, { "id": "01a0876c-4749-70a9-9b62-1c1fda95836b", "title": "Binary Rename 2", "url": "https://dfir.au/posts/2019/binaryrename2/", "published_at": "2019-05-29T00:00:00+00:00" }, { "id": "01a0876c-4749-70a9-9b62-1c1fdb50c457", "title": "Blue Team Hacks - Binary Rename", "url": "https://dfir.au/posts/2019/binaryrename/", "published_at": "2019-05-12T00:00:00+00:00" }, { "id": "01a0876c-4749-70a9-9b62-1c1fdc3d93de", "title": "Live Response Script Builder", "url": "https://dfir.au/posts/2019/invoke-liveresponse_builder/", "published_at": "2019-04-07T00:00:00+00:00" }, { "id": "01a0876c-4749-70a9-9b62-1c1fdcf19b49", "title": "Powershell Download Cradles", "url": "https://dfir.au/posts/2018/downloadcradle/", "published_at": "2018-04-02T00:00:00+00:00" }, { "id": "01a0876c-4749-70a9-9b62-1c1fdda12e49", "title": "Sharing my BITS", "url": "https://dfir.au/posts/2018/sharing_my_bits/", "published_at": "2018-02-18T00:00:00+00:00" }, { "id": "01a0876c-4749-70a9-9b62-1c1fde977840", "title": "Invoke-LiveResponse", "url": "https://dfir.au/posts/2018/invoke-liveresponse/", "published_at": "2018-01-14T00:00:00+00:00" }, { "id": "01a0876c-4749-70a9-9b62-1c1fded75d92", "title": "Invoke-LiveResponse", "url": "https://dfir.au/projects/invoke-liveresponse/", "published_at": "2018-01-14T00:00:00+00:00" }, { "id": "01a0876c-4749-70a9-9b62-1c1fdfabaeea", "title": "Blue Team Hacks - WMI Eventing", "url": "https://dfir.au/posts/2017/wmi_eventing/", "published_at": "2017-04-03T00:00:00+00:00" }, { "id": "01a0876c-4749-70a9-9b62-1c1fe097730f", "title": "PowerShell Remoting and Incident Response", "url": "https://dfir.au/posts/2017/powershell_remoting_ir/", "published_at": "2017-01-12T02:00:00+00:00" }, { "id": "01a0876c-4749-70a9-9b62-1c1fe17fa385", "title": "About", "url": "https://dfir.au/about/", "published_at": null } ] posts Claim your blog
Back to dfir.au
Blog · corpus.blog/blogs/dfir.au/posts

dfir.au

dfir.au

2025

CLRaptor: Hunting reflected assemblies with Velociraptororiginal ↗
1 Dec 2025
MCP Velociraptororiginal ↗
15 Apr 2025

2024

Finding the LNK: Techniques and methodology for advanced analysisoriginal ↗
1 Nov 2024
How To Hunt For UEFI Malwareoriginal ↗
29 Feb 2024

2023

DEATHcon2023: Practical DEATH by Velociraptororiginal ↗
20 Nov 2023
Content Management Like a Boss!original ↗
13 Sept 2023
Automating Qakbot decode at scaleoriginal ↗
5 Apr 2023

2022

Detectraptororiginal ↗
17 Nov 2022
DEATHcon 2022 Velociraptor workshoporiginal ↗
5 Nov 2022
Notebook and VQL - data munging your way to victory!original ↗
17 Sept 2022
WMI Event Consumers: what are you missing?original ↗
12 Jan 2022

2021

Cobalt Strike Payload Discovery And Data Manipulation In VQLoriginal ↗
9 Nov 2021

2020

Windows IPSEC for endpoint quarantineoriginal ↗
23 Jul 2020

2019

Local Live Response with Velociraptor ++original ↗
8 Dec 2019
Live response automation with Velociraptororiginal ↗
10 Nov 2019
Endpoint Hunting in an AntiEDR Worldoriginal ↗
26 Jun 2019
O365: Hidden InboxRulesoriginal ↗
9 Jun 2019
Binary Rename 2original ↗
29 May 2019
Blue Team Hacks - Binary Renameoriginal ↗
12 May 2019
Live Response Script Builderoriginal ↗
7 Apr 2019

2018

Powershell Download Cradlesoriginal ↗
2 Apr 2018
Sharing my BITSoriginal ↗
18 Feb 2018
Invoke-LiveResponseoriginal ↗
14 Jan 2018
Invoke-LiveResponseoriginal ↗
14 Jan 2018

2017

Blue Team Hacks - WMI Eventingoriginal ↗
3 Apr 2017
PowerShell Remoting and Incident Responseoriginal ↗
12 Jan 2017

Undated

Aboutoriginal ↗
—