41554 blogs · [ { "id": "01a0d7f8-2b16-71f5-a5e0-4698e22f5521", "title": "The .zshrc.zwc You Forgot to Check", "url": "https://dfir.ch/posts/compiled_zsh/", "published_at": "2026-09-21T23:03:20+00:00" }, { "id": "01a0b0c1-fa38-70cd-9518-5cb6d3fe638f", "title": "Living Inside the Shell: zsh Modules on macOS", "url": "https://dfir.ch/posts/zsh_modules/", "published_at": "2026-09-16T17:58:20+00:00" }, { "id": "01a0b0c1-fa39-701e-b43b-6a7dc816bf09", "title": "Field Notes: From AV Alert to Impacket", "url": "https://dfir.ch/posts/field_notes_av_impacket/", "published_at": "2026-09-11T04:04:20+00:00" }, { "id": "01a0b0c1-fa39-701e-b43b-6a7dc860b1f3", "title": "BSides Frankfurt: Deconstructing Modern macOS Initial Access Vectors", "url": "https://dfir.ch/talks/bsides_frankfurt_2026/", "published_at": "2026-09-10T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafaa76e0b1", "title": "Field Notes: NSSM - the Non-Sucking Service Manager", "url": "https://dfir.ch/posts/field_notes_nssm/", "published_at": "2026-07-27T04:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafaad91d71", "title": "Fantastic clear-text passwords and where to collect them (Part 2 - Windows)", "url": "https://dfir.ch/posts/fantastic_passwords_windows/", "published_at": "2026-06-28T23:03:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafabb91892", "title": "Fantastic clear-text passwords and where to collect them (Part 1 - Linux)", "url": "https://dfir.ch/posts/fantastic_passwords_linux/", "published_at": "2026-06-21T23:03:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafac04559d", "title": "Anatomy of a Deno-Based Proxy & RAT", "url": "https://dfir.ch/posts/deno/", "published_at": "2026-06-15T08:03:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafacc3a849", "title": "Brucon: Anti-Forensics (and Anti-Anti-Forensics) Techniques", "url": "https://dfir.ch/talks/brucon_2026/", "published_at": "2026-04-23T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafadaaf2e2", "title": "Botconf: Tomb Raider - In Search of the Lost Signatures", "url": "https://dfir.ch/talks/botconf_2026/", "published_at": "2026-04-15T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafae832726", "title": "FIRST Technical Colloquium Paris: Inside Mythic: Dissecting a Modern Attack Framework", "url": "https://dfir.ch/talks/first_paris_2026/", "published_at": "2026-03-08T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafaefe328d", "title": "Dissection of a PHP Backdoor leveraging php-win.exe", "url": "https://dfir.ch/posts/dissection_php_backdoor/", "published_at": "2025-11-16T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafaf74e68a", "title": "BSides Berlin: Inside Mythic: Dissecting a Modern Attack Framework", "url": "https://dfir.ch/talks/bsides_berlin_2025/", "published_at": "2025-11-08T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafaf8927fc", "title": "BSides Chisinau: Congratulations, You're Still Insecure!", "url": "https://dfir.ch/talks/bsides_chisinau_2025/", "published_at": "2025-10-31T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafb0181e1f", "title": "Today I learned: binfmt_misc", "url": "https://dfir.ch/posts/today_i_learned_binfmt_misc/", "published_at": "2025-10-30T02:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafb116d803", "title": "Hack.lu: Anti-Forensics - You are doing it wrong", "url": "https://dfir.ch/talks/hack.lu_2025/", "published_at": "2025-10-21T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafb1213e7d", "title": "Troopers: Anti-Forensics - You are doing it wrong", "url": "https://dfir.ch/talks/troopers_2025/", "published_at": "2025-06-25T14:04:20+00:00" }, { "id": "01a0876c-48c6-7340-9ad8-fcafb14417f0", "title": "FIRST Conference: Anti-Forensics - You are doing it wrong", "url": "https://dfir.ch/talks/firstcon_2025/", "published_at": "2025-06-24T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155201091145", "title": "Euskalhack: In-Depth Study Of Linux Rootkits", "url": "https://dfir.ch/talks/euskalhack_2025/", "published_at": "2025-06-20T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155201a11efb", "title": "x33fcon: From Zero to a Moderately Skilled MacOS Forensic Analyst", "url": "https://dfir.ch/talks/x33fcon_2025/", "published_at": "2025-06-12T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520273638d", "title": "SecurityFest: Anti-Forensics - You are doing it wrong", "url": "https://dfir.ch/talks/securityfest_2025/", "published_at": "2025-06-05T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155202782645", "title": "Linux Capabilities Revisited", "url": "https://dfir.ch/posts/linux_capabilities/", "published_at": "2025-05-16T01:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552036c06f8", "title": "BSides Transylvania: From Zero to a Moderately Skilled MacOS Forensic Analyst", "url": "https://dfir.ch/talks/bsides_transylvania_2025/", "published_at": "2025-05-10T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552045f3eaf", "title": "FIRST Technical Colloquium Amsterdam: In-Depth Study of Linux Rootkits", "url": "https://dfir.ch/talks/first_amsterdam_2025/", "published_at": "2025-03-27T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520552a91a", "title": "BSides Kent: The Gist of Hundreds of Incident Response Cases", "url": "https://dfir.ch/talks/bsides_kent_2025/", "published_at": "2025-03-22T14:04:20+00:00" }, { "id": "01a0b0c1-fa39-701e-b43b-6a7dd5c99f90", "title": "BSides Munich: Fantastic clear-text passwords and where to collect them", "url": "https://dfir.ch/talks/bsides_munich_2025/", "published_at": "2025-03-22T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155205c1ddad", "title": "Today I Learned - Protected Symlinks", "url": "https://dfir.ch/posts/today_i_learned_protected_symlinks/", "published_at": "2025-02-24T02:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520631d756", "title": "macOS Extended Attributes: Case Study", "url": "https://dfir.ch/posts/macos_extended_attributes/", "published_at": "2025-02-15T10:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552064fee16", "title": "Tear Down The Castle - Part 2", "url": "https://dfir.ch/posts/tear_down_castle_part_two/", "published_at": "2025-01-30T09:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552069cf329", "title": "Oh my .. ! - Suspicious network traffic detected including Ransomware", "url": "https://dfir.ch/posts/suspicious_network_traffic_ransomware/", "published_at": "2025-01-22T10:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155207824ad4", "title": "Tear Down The Castle - Part 1", "url": "https://dfir.ch/posts/tear_down_castle_part_one/", "published_at": "2025-01-19T02:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155207b0d8ac", "title": "Analysis of Python's .pth files as a persistence mechanism", "url": "https://dfir.ch/posts/publish_python_pth_extension/", "published_at": "2025-01-14T01:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155208204a01", "title": "Today I Learned - setfacl", "url": "https://dfir.ch/posts/today_i_learned_setfacl/", "published_at": "2024-12-17T06:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155208472b0c", "title": "Shell Script Compiler (shc)", "url": "https://dfir.ch/posts/shell_script_compiler/", "published_at": "2024-12-11T12:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520862c471", "title": "DeepSec: RAT Builders - How to catch them all", "url": "https://dfir.ch/talks/deepsec_2024/", "published_at": "2024-11-21T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155208e89a7d", "title": "BSides Munich: /proc for Security Analysts", "url": "https://dfir.ch/talks/bsides_munich_2024/", "published_at": "2024-11-11T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520929e5a8", "title": "Reptile's Custom Kernel-Module Launcher", "url": "https://dfir.ch/posts/reptile_launcher/", "published_at": "2024-11-10T12:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552099f63c0", "title": "Hack.lu: The Gist of Hundreds of Incident Response Cases", "url": "https://dfir.ch/talks/hack.lu_gist_2024/", "published_at": "2024-10-23T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155209fc8234", "title": "Hack.lu: In-Depth Study of Linux Rootkits: Evolution, Detection, and Defense", "url": "https://dfir.ch/talks/hack.lu_rootkits_2024/", "published_at": "2024-10-22T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520a8d66a9", "title": "bedevil: Dynamic Linker Patching", "url": "https://dfir.ch/posts/bedevil_dynamic_linker_patching/", "published_at": "2024-10-19T09:03:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520b007dac", "title": "Microsoft Defender XDR's Deception Technology", "url": "https://dfir.ch/posts/defender_xdr_deception/", "published_at": "2024-10-10T08:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520bbdb8c5", "title": "tmate - Instant Terminal Sharing (or How To Backdoor a Linux Server)", "url": "https://dfir.ch/posts/tmate_as_a_backdoor/", "published_at": "2024-10-06T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520ca681e3", "title": "EDR: The Great Escape - RomHack Training Review", "url": "https://dfir.ch/posts/romhack_edr/", "published_at": "2024-09-30T09:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520d47729f", "title": "Today I Learned - NSG Flow Log", "url": "https://dfir.ch/posts/today_i_learned_nsg_flow_log/", "published_at": "2024-09-21T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520ddba510", "title": "ScriptBlock Smuggling", "url": "https://dfir.ch/posts/scriptblock_smuggling/", "published_at": "2024-09-13T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520e03f4ef", "title": "Botnet Fenix", "url": "https://dfir.ch/posts/botnex_fenix/", "published_at": "2024-08-22T10:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520ec0b952", "title": "Today I Learned - WebDAV Cache", "url": "https://dfir.ch/posts/today_i_learned_webdav_cache/", "published_at": "2024-08-08T23:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15520f962642", "title": "Abusing the “search-ms” URI protocol handler", "url": "https://dfir.ch/posts/search-ms_protocol_handler/", "published_at": "2024-08-04T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552104017c0", "title": "Tainted Kernels", "url": "https://dfir.ch/posts/tainted_kernels/", "published_at": "2024-07-12T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155210762896", "title": "Today I Learned - kernel.modules_disabled", "url": "https://dfir.ch/posts/today_i_learned_lkm_kernel.modules_disabled/", "published_at": "2024-07-10T01:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155210b4a733", "title": "Systemd Path Activation - Poor Man's File Integrity", "url": "https://dfir.ch/posts/systemd_path_activation/", "published_at": "2024-06-22T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521133578f", "title": "From Dangerous PHP Functions to Webshell Hunting", "url": "https://dfir.ch/posts/php_dangerous_functions_and_webshell/", "published_at": "2024-06-17T07:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521210d701", "title": "FIRST Conference: (Advanced) Purple Teaming - BlueTeam Edition", "url": "https://dfir.ch/talks/firstcon_2024/", "published_at": "2024-06-09T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155212f00a6f", "title": "Today I Learned - Instrument ClamAV to extract AutoIT scripts", "url": "https://dfir.ch/posts/today_i_learned_clamav_autoit/", "published_at": "2024-06-09T02:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552138e4c88", "title": "SecurityFest: The Gist of Hundreds of Incident Response cases", "url": "https://dfir.ch/talks/securityfest_2024/", "published_at": "2024-05-31T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155213e1a644", "title": "Today I Learned - Zsh Sessions (even more Timestamps)", "url": "https://dfir.ch/posts/today_i_learned_zsh_sessions/", "published_at": "2024-05-26T07:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155214de6bb7", "title": "The 'Invisibility Cloak' - Slash-Proc Magic", "url": "https://dfir.ch/posts/slash-proc/", "published_at": "2024-05-16T08:40:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155215d84f9e", "title": "Removing Traces of RMM Tools", "url": "https://dfir.ch/posts/cleanup_script_rmm/", "published_at": "2024-05-10T07:26:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155216515989", "title": "Today I Learned - Zsh History Timestamps", "url": "https://dfir.ch/posts/today_i_learned_zsh_timestamps/", "published_at": "2024-05-07T17:58:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552168653d0", "title": "Canarytokens: Catching Insider Threats (and Threat Actors?)", "url": "https://dfir.ch/posts/canarytokens/", "published_at": "2024-05-06T07:15:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552175bf9b0", "title": "Today I Learned - Device Discovery", "url": "https://dfir.ch/posts/today_i_learned_device_discovery/", "published_at": "2024-04-27T06:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155218193ae5", "title": "Sysrv Infection (Linux Edition)", "url": "https://dfir.ch/posts/sysrv/", "published_at": "2024-04-14T13:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552181de373", "title": "Varia", "url": "https://dfir.ch/tweets/varia/", "published_at": "2024-04-03T14:27:19+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521899f65a", "title": "MicroSocks: Convenient access through a compromised SonicWall SMA", "url": "https://dfir.ch/posts/microsocks_sonicwall/", "published_at": "2024-03-30T06:15:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-1552196b4219", "title": "Azure Batch Misused for Crypto Mining", "url": "https://dfir.ch/posts/azure_batch/", "published_at": "2024-03-15T05:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-155219958492", "title": "Two in a row - You mitigated wrong (Kentico CMS RCE)", "url": "https://dfir.ch/posts/kentico_cms_rce/", "published_at": "2024-03-06T18:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521a8f786b", "title": "AWS Ransomware", "url": "https://dfir.ch/posts/aws_ransomware/", "published_at": "2024-02-21T03:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521aabd3ca", "title": "[s|l]trace - Linux Malware Analysis", "url": "https://dfir.ch/posts/strace/", "published_at": "2024-02-01T06:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521b44c237", "title": "Hunting AsyncRAT & QuasarRAT", "url": "https://dfir.ch/posts/asyncrat_quasarrat/", "published_at": "2024-01-15T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521b64cb86", "title": "Azure", "url": "https://dfir.ch/tweets/azure/", "published_at": "2024-01-10T14:27:19+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521bb3e428", "title": "DFIR", "url": "https://dfir.ch/tweets/dfir/", "published_at": "2024-01-10T14:27:19+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521c62ce94", "title": "Real-World PingCastle Findings", "url": "https://dfir.ch/tweets/pingcastle/", "published_at": "2024-01-09T14:27:19+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521d4a7ff7", "title": "N-IOCs to Rule Them All", "url": "https://dfir.ch/posts/n-iocs/", "published_at": "2023-12-31T17:13:36+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521da9494f", "title": "Threat Hunting", "url": "https://dfir.ch/tweets/threathunting/", "published_at": "2023-08-11T14:27:19+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521e149707", "title": "FIRST Conference: N-IOCs to Rule Them All", "url": "https://dfir.ch/talks/firstcon_2023/", "published_at": "2023-05-05T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521e23a779", "title": "Swiss Cyber Storm: The Seven Deadly Sins", "url": "https://dfir.ch/talks/swisscyberstorm_2022/", "published_at": "2022-10-25T14:04:20+00:00" }, { "id": "01a0876c-48c7-7397-8ce9-15521ecb96d9", "title": "Swiss Cyber Storm: Ransomware in Switzerland and around the World", "url": "https://dfir.ch/talks/swisscyberstorm_2021/", "published_at": "2021-10-12T14:04:20+00:00" }, { "id": "01a0d7f8-2b16-71f5-a5e0-46990809c53a", "title": null, "url": "https://dfir.ch/posts/__tweet/", "published_at": null } ] posts Claim your blog
Back to dfir.ch
Blog · corpus.blog/blogs/dfir.ch/posts

dfir.ch

dfir.ch

2026

2025

2024

10 Jan 2024

2023

2022

2021

Undated