corpus.blog
41554 blogs · [ { "id": "01a0d7f8-2b16-71f5-a5e0-4698e22f5521", "title": "The .zshrc.zwc You Forgot to Check", "url": "https://dfir.ch/posts/compiled_zsh/", "published_at": "2026-09-21T23:03:20+00:00" }, { "id": "01a0b0c1-fa38-70cd-9518-5cb6d3fe638f", "title": "Living Inside the Shell: zsh Modules on macOS", "url": "https://dfir.ch/posts/zsh_modules/", "published_at": "2026-09-16T17:58:20+00:00" }, { "id": "01a0b0c1-fa39-701e-b43b-6a7dc816bf09", "title": "Field Notes: From AV Alert to Impacket", "url": "https://dfir.ch/posts/field_notes_av_impacket/", "published_at": "2026-09-11T04:04:20+00:00" }, { "id": "01a0b0c1-fa39-701e-b43b-6a7dc860b1f3", "title": "BSides Frankfurt: Deconstructing Modern macOS Initial Access Vectors", "url": "https://dfir.ch/talks/bsides_frankfurt_2026/", "published_at": "2026-09-10T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafaa76e0b1", "title": "Field Notes: NSSM - the Non-Sucking Service Manager", "url": "https://dfir.ch/posts/field_notes_nssm/", "published_at": "2026-07-27T04:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafaad91d71", "title": "Fantastic clear-text passwords and where to collect them (Part 2 - Windows)", "url": "https://dfir.ch/posts/fantastic_passwords_windows/", "published_at": "2026-06-28T23:03:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafabb91892", "title": "Fantastic clear-text passwords and where to collect them (Part 1 - Linux)", "url": "https://dfir.ch/posts/fantastic_passwords_linux/", "published_at": "2026-06-21T23:03:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafac04559d", "title": "Anatomy of a Deno-Based Proxy & RAT", "url": "https://dfir.ch/posts/deno/", "published_at": "2026-06-15T08:03:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafacc3a849", "title": "Brucon: Anti-Forensics (and Anti-Anti-Forensics) Techniques", "url": "https://dfir.ch/talks/brucon_2026/", "published_at": "2026-04-23T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafadaaf2e2", "title": "Botconf: Tomb Raider - In Search of the Lost Signatures", "url": "https://dfir.ch/talks/botconf_2026/", "published_at": "2026-04-15T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafae832726", "title": "FIRST Technical Colloquium Paris: Inside Mythic: Dissecting a Modern Attack Framework", "url": "https://dfir.ch/talks/first_paris_2026/", "published_at": "2026-03-08T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafaefe328d", "title": "Dissection of a PHP Backdoor leveraging php-win.exe", "url": "https://dfir.ch/posts/dissection_php_backdoor/", "published_at": "2025-11-16T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafaf74e68a", "title": "BSides Berlin: Inside Mythic: Dissecting a Modern Attack Framework", "url": "https://dfir.ch/talks/bsides_berlin_2025/", "published_at": "2025-11-08T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafaf8927fc", "title": "BSides Chisinau: Congratulations, You're Still Insecure!", "url": "https://dfir.ch/talks/bsides_chisinau_2025/", "published_at": "2025-10-31T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafb0181e1f", "title": "Today I learned: binfmt_misc", "url": "https://dfir.ch/posts/today_i_learned_binfmt_misc/", "published_at": "2025-10-30T02:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafb116d803", "title": "Hack.lu: Anti-Forensics - You are doing it wrong", "url": "https://dfir.ch/talks/hack.lu_2025/", "published_at": "2025-10-21T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafb1213e7d", "title": "Troopers: Anti-Forensics - You are doing it wrong", "url": "https://dfir.ch/talks/troopers_2025/", "published_at": "2025-06-25T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafb14417f0", "title": "FIRST Conference: Anti-Forensics - You are doing it wrong", "url": "https://dfir.ch/talks/firstcon_2025/", "published_at": "2025-06-24T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155201091145", "title": "Euskalhack: In-Depth Study Of Linux Rootkits", "url": "https://dfir.ch/talks/euskalhack_2025/", "published_at": "2025-06-20T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155201a11efb", "title": "x33fcon: From Zero to a Moderately Skilled MacOS Forensic Analyst", "url": "https://dfir.ch/talks/x33fcon_2025/", "published_at": "2025-06-12T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520273638d", "title": "SecurityFest: Anti-Forensics - You are doing it wrong", "url": "https://dfir.ch/talks/securityfest_2025/", "published_at": "2025-06-05T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155202782645", "title": "Linux Capabilities Revisited", "url": "https://dfir.ch/posts/linux_capabilities/", "published_at": "2025-05-16T01:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552036c06f8", "title": "BSides Transylvania: From Zero to a Moderately Skilled MacOS Forensic Analyst", "url": "https://dfir.ch/talks/bsides_transylvania_2025/", "published_at": "2025-05-10T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552045f3eaf", "title": "FIRST Technical Colloquium Amsterdam: In-Depth Study of Linux Rootkits", "url": "https://dfir.ch/talks/first_amsterdam_2025/", "published_at": "2025-03-27T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520552a91a", "title": "BSides Kent: The Gist of Hundreds of Incident Response Cases", "url": "https://dfir.ch/talks/bsides_kent_2025/", "published_at": "2025-03-22T14:04:20+00:00" }, { "id": "01a0b0c1-fa39-701e-b43b-6a7dd5c99f90", "title": "BSides Munich: Fantastic clear-text passwords and where to collect them", "url": "https://dfir.ch/talks/bsides_munich_2025/", "published_at": "2025-03-22T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155205c1ddad", "title": "Today I Learned - Protected Symlinks", "url": "https://dfir.ch/posts/today_i_learned_protected_symlinks/", "published_at": "2025-02-24T02:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520631d756", "title": "macOS Extended Attributes: Case Study", "url": "https://dfir.ch/posts/macos_extended_attributes/", "published_at": "2025-02-15T10:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552064fee16", "title": "Tear Down The Castle - Part 2", "url": "https://dfir.ch/posts/tear_down_castle_part_two/", "published_at": "2025-01-30T09:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552069cf329", "title": "Oh my .. ! - Suspicious network traffic detected including Ransomware", "url": "https://dfir.ch/posts/suspicious_network_traffic_ransomware/", "published_at": "2025-01-22T10:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155207824ad4", "title": "Tear Down The Castle - Part 1", "url": "https://dfir.ch/posts/tear_down_castle_part_one/", "published_at": "2025-01-19T02:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155207b0d8ac", "title": "Analysis of Python's .pth files as a persistence mechanism", "url": "https://dfir.ch/posts/publish_python_pth_extension/", "published_at": "2025-01-14T01:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155208204a01", "title": "Today I Learned - setfacl", "url": "https://dfir.ch/posts/today_i_learned_setfacl/", "published_at": "2024-12-17T06:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155208472b0c", "title": "Shell Script Compiler (shc)", "url": "https://dfir.ch/posts/shell_script_compiler/", "published_at": "2024-12-11T12:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520862c471", "title": "DeepSec: RAT Builders - How to catch them all", "url": "https://dfir.ch/talks/deepsec_2024/", "published_at": "2024-11-21T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155208e89a7d", "title": "BSides Munich: /proc for Security Analysts", "url": "https://dfir.ch/talks/bsides_munich_2024/", "published_at": "2024-11-11T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520929e5a8", "title": "Reptile's Custom Kernel-Module Launcher", "url": "https://dfir.ch/posts/reptile_launcher/", "published_at": "2024-11-10T12:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552099f63c0", "title": "Hack.lu: The Gist of Hundreds of Incident Response Cases", "url": "https://dfir.ch/talks/hack.lu_gist_2024/", "published_at": "2024-10-23T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155209fc8234", "title": "Hack.lu: In-Depth Study of Linux Rootkits: Evolution, Detection, and Defense", "url": "https://dfir.ch/talks/hack.lu_rootkits_2024/", "published_at": "2024-10-22T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520a8d66a9", "title": "bedevil: Dynamic Linker Patching", "url": "https://dfir.ch/posts/bedevil_dynamic_linker_patching/", "published_at": "2024-10-19T09:03:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520b007dac", "title": "Microsoft Defender XDR's Deception Technology", "url": "https://dfir.ch/posts/defender_xdr_deception/", "published_at": "2024-10-10T08:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520bbdb8c5", "title": "tmate - Instant Terminal Sharing (or How To Backdoor a Linux Server)", "url": "https://dfir.ch/posts/tmate_as_a_backdoor/", "published_at": "2024-10-06T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520ca681e3", "title": "EDR: The Great Escape - RomHack Training Review", "url": "https://dfir.ch/posts/romhack_edr/", "published_at": "2024-09-30T09:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520d47729f", "title": "Today I Learned - NSG Flow Log", "url": "https://dfir.ch/posts/today_i_learned_nsg_flow_log/", "published_at": "2024-09-21T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520ddba510", "title": "ScriptBlock Smuggling", "url": "https://dfir.ch/posts/scriptblock_smuggling/", "published_at": "2024-09-13T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520e03f4ef", "title": "Botnet Fenix", "url": "https://dfir.ch/posts/botnex_fenix/", "published_at": "2024-08-22T10:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520ec0b952", "title": "Today I Learned - WebDAV Cache", "url": "https://dfir.ch/posts/today_i_learned_webdav_cache/", "published_at": "2024-08-08T23:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520f962642", "title": "Abusing the “search-ms” URI protocol handler", "url": "https://dfir.ch/posts/search-ms_protocol_handler/", "published_at": "2024-08-04T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552104017c0", "title": "Tainted Kernels", "url": "https://dfir.ch/posts/tainted_kernels/", "published_at": "2024-07-12T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155210762896", "title": "Today I Learned - kernel.modules_disabled", "url": "https://dfir.ch/posts/today_i_learned_lkm_kernel.modules_disabled/", "published_at": "2024-07-10T01:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155210b4a733", "title": "Systemd Path Activation - Poor Man's File Integrity", "url": "https://dfir.ch/posts/systemd_path_activation/", "published_at": "2024-06-22T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521133578f", "title": "From Dangerous PHP Functions to Webshell Hunting", "url": "https://dfir.ch/posts/php_dangerous_functions_and_webshell/", "published_at": "2024-06-17T07:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521210d701", "title": "FIRST Conference: (Advanced) Purple Teaming - BlueTeam Edition", "url": "https://dfir.ch/talks/firstcon_2024/", "published_at": "2024-06-09T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155212f00a6f", "title": "Today I Learned - Instrument ClamAV to extract AutoIT scripts", "url": "https://dfir.ch/posts/today_i_learned_clamav_autoit/", "published_at": "2024-06-09T02:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552138e4c88", "title": "SecurityFest: The Gist of Hundreds of Incident Response cases", "url": "https://dfir.ch/talks/securityfest_2024/", "published_at": "2024-05-31T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155213e1a644", "title": "Today I Learned - Zsh Sessions (even more Timestamps)", "url": "https://dfir.ch/posts/today_i_learned_zsh_sessions/", "published_at": "2024-05-26T07:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155214de6bb7", "title": "The 'Invisibility Cloak' - Slash-Proc Magic", "url": "https://dfir.ch/posts/slash-proc/", "published_at": "2024-05-16T08:40:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155215d84f9e", "title": "Removing Traces of RMM Tools", "url": "https://dfir.ch/posts/cleanup_script_rmm/", "published_at": "2024-05-10T07:26:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155216515989", "title": "Today I Learned - Zsh History Timestamps", "url": "https://dfir.ch/posts/today_i_learned_zsh_timestamps/", "published_at": "2024-05-07T17:58:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552168653d0", "title": "Canarytokens: Catching Insider Threats (and Threat Actors?)", "url": "https://dfir.ch/posts/canarytokens/", "published_at": "2024-05-06T07:15:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552175bf9b0", "title": "Today I Learned - Device Discovery", "url": "https://dfir.ch/posts/today_i_learned_device_discovery/", "published_at": "2024-04-27T06:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155218193ae5", "title": "Sysrv Infection (Linux Edition)", "url": "https://dfir.ch/posts/sysrv/", "published_at": "2024-04-14T13:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552181de373", "title": "Varia", "url": "https://dfir.ch/tweets/varia/", "published_at": "2024-04-03T14:27:19+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521899f65a", "title": "MicroSocks: Convenient access through a compromised SonicWall SMA", "url": "https://dfir.ch/posts/microsocks_sonicwall/", "published_at": "2024-03-30T06:15:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552196b4219", "title": "Azure Batch Misused for Crypto Mining", "url": "https://dfir.ch/posts/azure_batch/", "published_at": "2024-03-15T05:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155219958492", "title": "Two in a row - You mitigated wrong (Kentico CMS RCE)", "url": "https://dfir.ch/posts/kentico_cms_rce/", "published_at": "2024-03-06T18:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521a8f786b", "title": "AWS Ransomware", "url": "https://dfir.ch/posts/aws_ransomware/", "published_at": "2024-02-21T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521aabd3ca", "title": "[s|l]trace - Linux Malware Analysis", "url": "https://dfir.ch/posts/strace/", "published_at": "2024-02-01T06:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521b44c237", "title": "Hunting AsyncRAT & QuasarRAT", "url": "https://dfir.ch/posts/asyncrat_quasarrat/", "published_at": "2024-01-15T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521b64cb86", "title": "Azure", "url": "https://dfir.ch/tweets/azure/", "published_at": "2024-01-10T14:27:19+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521bb3e428", "title": "DFIR", "url": "https://dfir.ch/tweets/dfir/", "published_at": "2024-01-10T14:27:19+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521c62ce94", "title": "Real-World PingCastle Findings", "url": "https://dfir.ch/tweets/pingcastle/", "published_at": "2024-01-09T14:27:19+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521d4a7ff7", "title": "N-IOCs to Rule Them All", "url": "https://dfir.ch/posts/n-iocs/", "published_at": "2023-12-31T17:13:36+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521da9494f", "title": "Threat Hunting", "url": "https://dfir.ch/tweets/threathunting/", "published_at": "2023-08-11T14:27:19+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521e149707", "title": "FIRST Conference: N-IOCs to Rule Them All", "url": "https://dfir.ch/talks/firstcon_2023/", "published_at": "2023-05-05T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521e23a779", "title": "Swiss Cyber Storm: The Seven Deadly Sins", "url": "https://dfir.ch/talks/swisscyberstorm_2022/", "published_at": "2022-10-25T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521ecb96d9", "title": "Swiss Cyber Storm: Ransomware in Switzerland and around the World", "url": "https://dfir.ch/talks/swisscyberstorm_2021/", "published_at": "2021-10-12T14:04:20+00:00" }, { "id": "01a0d7f8-2b16-71f5-a5e0-46990809c53a", "title": null, "url": "https://dfir.ch/posts/__tweet/", "published_at": null } ] posts Claim your blog
Back to dfir.ch
Blog · corpus.blog/blogs/dfir.ch/posts

dfir.ch

dfir.ch

2026

The .zshrc.zwc You Forgot to Checkoriginal ↗
21 Sept 2026
Living Inside the Shell: zsh Modules on macOSoriginal ↗
16 Sept 2026
Field Notes: From AV Alert to Impacketoriginal ↗
11 Sept 2026
BSides Frankfurt: Deconstructing Modern macOS Initial Access Vectorsoriginal ↗
10 Sept 2026
Field Notes: NSSM - the Non-Sucking Service Manageroriginal ↗
27 Jul 2026
Fantastic clear-text passwords and where to collect them (Part 2 - Windows)original ↗
28 Jun 2026
Fantastic clear-text passwords and where to collect them (Part 1 - Linux)original ↗
21 Jun 2026
Anatomy of a Deno-Based Proxy & RAToriginal ↗
15 Jun 2026
Brucon: Anti-Forensics (and Anti-Anti-Forensics) Techniquesoriginal ↗
23 Apr 2026
Botconf: Tomb Raider - In Search of the Lost Signaturesoriginal ↗
15 Apr 2026
FIRST Technical Colloquium Paris: Inside Mythic: Dissecting a Modern Attack Frameworkoriginal ↗
8 Mar 2026

2025

Dissection of a PHP Backdoor leveraging php-win.exeoriginal ↗
16 Nov 2025
BSides Berlin: Inside Mythic: Dissecting a Modern Attack Frameworkoriginal ↗
8 Nov 2025
BSides Chisinau: Congratulations, You're Still Insecure!original ↗
31 Oct 2025
Today I learned: binfmt_miscoriginal ↗
30 Oct 2025
Hack.lu: Anti-Forensics - You are doing it wrongoriginal ↗
21 Oct 2025
Troopers: Anti-Forensics - You are doing it wrongoriginal ↗
25 Jun 2025
FIRST Conference: Anti-Forensics - You are doing it wrongoriginal ↗
24 Jun 2025
Euskalhack: In-Depth Study Of Linux Rootkitsoriginal ↗
20 Jun 2025
x33fcon: From Zero to a Moderately Skilled MacOS Forensic Analystoriginal ↗
12 Jun 2025
SecurityFest: Anti-Forensics - You are doing it wrongoriginal ↗
5 Jun 2025
Linux Capabilities Revisitedoriginal ↗
16 May 2025
BSides Transylvania: From Zero to a Moderately Skilled MacOS Forensic Analystoriginal ↗
10 May 2025
FIRST Technical Colloquium Amsterdam: In-Depth Study of Linux Rootkitsoriginal ↗
27 Mar 2025
BSides Kent: The Gist of Hundreds of Incident Response Casesoriginal ↗
22 Mar 2025
BSides Munich: Fantastic clear-text passwords and where to collect themoriginal ↗
22 Mar 2025
Today I Learned - Protected Symlinksoriginal ↗
24 Feb 2025
macOS Extended Attributes: Case Studyoriginal ↗
15 Feb 2025
Tear Down The Castle - Part 2original ↗
30 Jan 2025
Oh my .. ! - Suspicious network traffic detected including Ransomwareoriginal ↗
22 Jan 2025
Tear Down The Castle - Part 1original ↗
19 Jan 2025
Analysis of Python's .pth files as a persistence mechanismoriginal ↗
14 Jan 2025

2024

Today I Learned - setfacloriginal ↗
17 Dec 2024
Shell Script Compiler (shc)original ↗
11 Dec 2024
DeepSec: RAT Builders - How to catch them alloriginal ↗
21 Nov 2024
BSides Munich: /proc for Security Analystsoriginal ↗
11 Nov 2024
Reptile's Custom Kernel-Module Launcheroriginal ↗
10 Nov 2024
Hack.lu: The Gist of Hundreds of Incident Response Casesoriginal ↗
23 Oct 2024
Hack.lu: In-Depth Study of Linux Rootkits: Evolution, Detection, and Defenseoriginal ↗
22 Oct 2024
bedevil: Dynamic Linker Patchingoriginal ↗
19 Oct 2024
Microsoft Defender XDR's Deception Technologyoriginal ↗
10 Oct 2024
tmate - Instant Terminal Sharing (or How To Backdoor a Linux Server)original ↗
6 Oct 2024
EDR: The Great Escape - RomHack Training Revieworiginal ↗
30 Sept 2024
Today I Learned - NSG Flow Logoriginal ↗
21 Sept 2024
ScriptBlock Smugglingoriginal ↗
13 Sept 2024
Botnet Fenixoriginal ↗
22 Aug 2024
Today I Learned - WebDAV Cacheoriginal ↗
8 Aug 2024
Abusing the “search-ms” URI protocol handleroriginal ↗
4 Aug 2024
Tainted Kernelsoriginal ↗
12 Jul 2024
Today I Learned - kernel.modules_disabledoriginal ↗
10 Jul 2024
Systemd Path Activation - Poor Man's File Integrityoriginal ↗
22 Jun 2024
From Dangerous PHP Functions to Webshell Huntingoriginal ↗
17 Jun 2024
FIRST Conference: (Advanced) Purple Teaming - BlueTeam Editionoriginal ↗
9 Jun 2024
Today I Learned - Instrument ClamAV to extract AutoIT scriptsoriginal ↗
9 Jun 2024
SecurityFest: The Gist of Hundreds of Incident Response casesoriginal ↗
31 May 2024
Today I Learned - Zsh Sessions (even more Timestamps)original ↗
26 May 2024
The 'Invisibility Cloak' - Slash-Proc Magicoriginal ↗
16 May 2024
Removing Traces of RMM Toolsoriginal ↗
10 May 2024
Today I Learned - Zsh History Timestampsoriginal ↗
7 May 2024
Canarytokens: Catching Insider Threats (and Threat Actors?)original ↗
6 May 2024
Today I Learned - Device Discoveryoriginal ↗
27 Apr 2024
Sysrv Infection (Linux Edition)original ↗
14 Apr 2024
Variaoriginal ↗
3 Apr 2024
MicroSocks: Convenient access through a compromised SonicWall SMAoriginal ↗
30 Mar 2024
Azure Batch Misused for Crypto Miningoriginal ↗
15 Mar 2024
Two in a row - You mitigated wrong (Kentico CMS RCE)original ↗
6 Mar 2024
AWS Ransomwareoriginal ↗
21 Feb 2024
[s|l]trace - Linux Malware Analysisoriginal ↗
1 Feb 2024
Hunting AsyncRAT & QuasarRAToriginal ↗
15 Jan 2024
Azureoriginal ↗
10 Jan 2024
DFIRoriginal ↗
10 Jan 2024
Real-World PingCastle Findingsoriginal ↗
9 Jan 2024

2023

N-IOCs to Rule Them Alloriginal ↗
31 Dec 2023
Threat Huntingoriginal ↗
11 Aug 2023
FIRST Conference: N-IOCs to Rule Them Alloriginal ↗
5 May 2023

2022

Swiss Cyber Storm: The Seven Deadly Sinsoriginal ↗
25 Oct 2022

2021

Swiss Cyber Storm: Ransomware in Switzerland and around the Worldoriginal ↗
12 Oct 2021

Undated

https://dfir.ch/posts/__tweet/original ↗
—