Logo
Picture

MC @grayfold3d

#DFIR Virginia, USA Joined June 2018
  • Tweets
    234
  • Followers
    366
  • Following
    328
  • Likes
    1K
grayfold3d Profile Picture

MC @grayfold3d

5 years ago

@mhallman Value=3. I’ve parsed the prefetch with pecmd and see other entries on the date in question so just not sure why it’s not being recorded or was deleted. I seem to recall reading somewhere about cases where a pf file might not be created if it opened quickly but can’t find it now

grayfold3d Profile Picture

MC @grayfold3d

5 years ago

#dfir question...Under what conditions would a program execution fail to create a prefetch file/prefetch file be deleted? Running Win10 and I have pf files with dates prior to the known execution of this application so I don’t think it’s getting removed due to a size limit.

grayfold3d Profile Picture

MC @grayfold3d

5 years ago

@mhallman I also see execution evidence in amcache, appcompatcache

grayfold3d Profile Picture

MC @grayfold3d

5 years ago

@mhallman Yep. One of the applications I’m looking at is TeamViewer. I know it was installed/executed due to its application logs but there are no prefetch entries. I’ve run this app in a lab and see pf files for the installer and application. Don’t have FD image to carve unfortunately

grayfold3d Profile Picture

MC @grayfold3d

5 years ago

I should note these entries would be months old but I know this app does create pf files.

grayfold3d Profile Picture

MC @grayfold3d

5 years ago

@bmmaloney97 The same is true in Splunk

grayfold3d Profile Picture

MC @grayfold3d

6 years ago

Well...no logs. This seems like a great idea. “No logs are created on either the helper’s or sharer’s device” docs.microsoft.com/en-us/windows/…

grayfold3d Profile Picture

MC @grayfold3d

6 years ago

Anyone aware of any logs showing sessions/connections from Microsoft Quick Assist (newer more user friendly Remote Assistance)? Not seeing anything in the normal RDP logs.

grayfold3d Profile Picture

MC @grayfold3d

6 years ago

@bettersafetynet I love the fact that git is built into new Windows versions (starting at 1909 I think). I just run it from PS prompt now

grayfold3d Profile Picture

MC @grayfold3d

6 years ago

@find_evil #stopthescale

grayfold3d Profile Picture

MC @grayfold3d

6 years ago

@AkashhSawant @SwiftOnSecurity Administrative templates: docs.microsoft.com/en-us/troubles…

grayfold3d Profile Picture

MC @grayfold3d

6 years ago

Anyone know of good OSX forensic resources similar to the SANS “evidence of” posters?

grayfold3d Profile Picture

MC @grayfold3d

6 years ago

@cglyer @m1ru1 We use a OneNote template with many of the things you listed. Just copy the template with each new investigation. Tables for timelines, IOCs etc. The only downside from my view is you can’t easily sort like you can in Excel.

MC retweeted
Lee_Holmes Profile Picture

Lee Holmes @Lee_Holmes

6 years ago

I've always thought a "PowerShell for PHBs" presentation would be fun. Here's one I used today to figure out what's been important to me recently. In Outlook, select your last 6 months of "Sent Items", and press CTRL-C. Then voila!

MC retweeted
hal_pomeranz Profile Picture

Hal Pomeranz @hal_pomeranz

6 years ago

My Linux Forensics material is now up at archive.org -- grab the torrent from archive.org/download/HalLi…

grayfold3d Profile Picture

MC @grayfold3d

6 years ago

@byteya @EricRZimmerman Haha if there’s one thing I know, it’s that if @ericzimmerman writes it, it will be in C# and not Python

grayfold3d Profile Picture

MC @grayfold3d

6 years ago

@HighViscosity Awesome post! First time of I’ve seen or heard of LNK files created from searches.

grayfold3d Profile Picture

MC @grayfold3d

7 years ago

@ItsReallyNick @SBousseaden Yeah typically the same documents. But around 20 different pdf, CSV, etc. What I’ve seen have been things like contact sheets and other ref docs. There’s been a bunch of back and forth between our team and the business unit he works in with all the reasons this is a bad idea.

grayfold3d Profile Picture

MC @grayfold3d

7 years ago

@SBousseaden We have a guy that likes putting office docs in his startup folder. How his machine manages to start with alll those files loading at startup is beyond me. Oh EDR loves him too 😑

grayfold3d Profile Picture

MC @grayfold3d

7 years ago

@brianjmoran My wife and I play a game where she tells me the Hallmark movie name and I have to guess what it’s about. I’ve got a 75% success rate.

Trends for United States

Mbappe
#AriZonaGolfWang
LeBron
Kawhi
Constitution
Lakers
SCOTUS
Supreme Court
Raptors
14th Amendment
Clippers
#WWENXT
Cam Schlittler
Cathy
Serena
Kobe
Barcola
Toronto
Francia
Clarence Thomas

You might like

DFIR R&D guy
Yogesh Khatri
@SwiftForensics
2K Followers
#DFIR & #DFIRFit geek, SANS Author/Instructor #FOR308, Instructor #FOR500. All opinions mine.
Kathryn Hedley
@4enzikat0r
3K Followers
Willi Ballenthin
@williballenthin
7K Followers
Lead Solutions Engineer @ LimaCharlie, BlackHat Instructor, SANS Analyst/Instructor, Security Researcher. Cybersecurity mentor.
Matt Bromiley (🇺�...
@_bromiley
7K Followers
DFIR_TNT
@DFIR_TNT
981 Followers
Nate
@nnwakelam
43K Followers
Archaeologist. I dig thru digital dirt to find artifacts of battles with mercenaries fought within corporate empires. I analyze fragments of rotting logs. #DFIR
𝙳𝚊𝚗
@4n68r
1K Followers
Brian Maloney
@bmmaloney97
3K Followers
Digital Forensics Researcher and Educator #dfir #NOLA
Joe T. Sylve, Ph.D.
@jtsylve
1K Followers
I lead @mitreattack. Ask me about deception, but don't believe the answers. Non ATT&CK tweets only speak for me. @whatshisface@infosec.exchange
Adam Pennington
@_whatshisface
4K Followers
| CTO @specterops | Host @dcpthepodcast | Ex PowerShell MVP | USAF Vet | FC Bayern Supporter | Language Learner 🇳🇴 🇮🇹 🇧🇷 |
Jared Atkinson
@jaredcatkinson
10K Followers