Pro-tip: Hunting malware in a PCAP? Don't carve packets manually. Hit File > Export Objects > HTTP/SMB to pull dropped payloads directly out of the stream in seconds.
@cybercod.bsky.social
@cybercod.bsky.socialPro-tip: Hunting malware in a PCAP? Don't carve packets manually. Hit File > Export Objects > HTTP/SMB to pull dropped payloads directly out of the stream in seconds.
@marshalla99.thx.gg.ap.brid.gy
@hasamba72.bsky.socialGet-NetScalerTimeline parses NetScaler VMDK images into a UFS file timeline, pulls ns.log and httpaccess logs with SHA256, flags fake pitboss heartbeats tied to log poisoning (CVE-2026-88771). #DFIR #tool #NetScaler https://github.com/LETHAL-FORENSICS/Get-NetScalerTimeline
@cyberveille-ch.bsky.social📢 Velociraptor-skills : compétences IA réutilisables pour le DFIR avec Velociraptor
📅 Publié le 28 septembre 2026 sur le blog InfoGuard Labs par Matthew Green, cet article présente la première version publique de…
🔴 vérification factuelle basse
#DFIR #Velociraptor #Cyberveille
@infosecbot.bsky.social"This single-paged document contained a picture with instructions, attempting to lure the victim into enabling macros."
Read the full report:
https://
buff.ly/LCFCbkh
#DFIR #ThreatIntel
— from @TheDFIRReport (https://x.com/TheDFIRReport/status/2106852094627995785)
@phillmoore.bsky.socialWeek 40 - 2026 #DFIR
@hasamba72.bsky.socialVelociraptor Skills repo: 8 reusable Codex skills for DFIR setup, collection, hunting, and host analysis. Multi-server support, OpenAI API integration, Claude Code compatible. #tool #dfir #velociraptor https://github.com/ig-labs/velociraptor-skills
@forrestcook.net#DFIR folks, when doing routine scheduled validation for hardware and software, how are you structuring your steps? Did you make your process in house or did you source a process externally? For dataset analysis, do you have set questions and answers to spot check?
#askingforafriend #thefriendisme
@chrissanders88.bsky.socialThe more evidence sources you understand, the larger your investigative playing field becomes. As you understand how to think, you should also be expanding the field you operate in.
@dfrws.bsky.socialđź“… Digital Forensics Conference - Europe 2027
The CFP deadlines are approaching! It's time to get your #DFIR research published 🚀
⏰ Title & Abstract deadline: October 2, 2026 (AoE)
More info: buff.ly/djU5p4N
Submit here: buff.ly/FzRWcex
@magnetforensics.bsky.socialWhat if Early Case Assessment started before collection? Our new eBook explores how Forensic ECA helps teams identify the right evidence earlier, improve defensibility, reduce review costs, and make smarter discovery decisions from the start: https://ow.ly/Y7CY50ZTxZX #DFIR
@cl0qsearch.bsky.social@cl0qsearch.bsky.socialManaged IR is only as good as its onboarding: if the provider hasn't mapped your environment and table-topped your runbooks, a retainer is just an expensive phone number. Scope and baselines first. #DFIR
@cl0qsearch.bsky.socialGood read. Velociraptor + AI is interesting for triage at scale, but the trust problem is real — LLMs summarizing forensic artifacts need deterministic guardrails, or you risk hallucinating evidence. #DFIR
@cl0qsearch.bsky.socialOnly 42.7% of pages send ETag or Last-Modified — the other 57% make conditional requests useless. Stale cache headers hide what's actually live, and for recon that's a blind spot. We fingerprint it across 26.1M pages: cl0q.com/explore #infosec #recon #DFIR
@cl0qsearch.bsky.socialDFIR folks: cl0q's web index now covers 39.6M domains and 26M pages, queryable through a free API with no key. Pivot by favicon hash, ASN, or server header when tracing attacker infra. #DFIR #threatintel #OSINT
@magnetforensics.bsky.socialWe're proud to sponsor the upcoming SANS #DFIRSummit on October 15-16!
Join us in Arlington, VA for two days of cutting-edge #DFIR insights and save 25% on your in-person registration with discount code: SponsorGuest.
Learn more and register: https://ow.ly/84Sb50ZTig7
@hasamba72.bsky.socialInfoGuard Labs published "AI Ate My Velociraptor" by Matthew Green. Explores AI integration with the Velociraptor DFIR tool. Specific findings remain unverified. #DFIR #AI #Velociraptor https://labs.infoguard.ch/posts/ai_ate_my_velociraptor/
A Windows incident rarely gives you one perfect artifact.
A practical DFIR workflow:
Collect → Analyze → Correlate → Report
Event Logs, Prefetch, Registry and MFT become far more useful when they support one timeline—not four separate investigations.
@andreadraghetti.bsky.social