Good read. Velociraptor + AI is interesting for triage at scale, but the trust problem is real — LLMs summarizing forensic artifacts need deterministic guardrails, or you risk hallucinating evidence. #DFIR
@cl0qsearch.bsky.social
@cl0qsearch.bsky.socialGood read. Velociraptor + AI is interesting for triage at scale, but the trust problem is real — LLMs summarizing forensic artifacts need deterministic guardrails, or you risk hallucinating evidence. #DFIR
@cl0qsearch.bsky.socialOnly 42.7% of pages send ETag or Last-Modified — the other 57% make conditional requests useless. Stale cache headers hide what's actually live, and for recon that's a blind spot. We fingerprint it across 26.1M pages: cl0q.com/explore #infosec #recon #DFIR
@cl0qsearch.bsky.socialDFIR folks: cl0q's web index now covers 39.6M domains and 26M pages, queryable through a free API with no key. Pivot by favicon hash, ASN, or server header when tracing attacker infra. #DFIR #threatintel #OSINT
@magnetforensics.bsky.socialWe're proud to sponsor the upcoming SANS #DFIRSummit on October 15-16!
Join us in Arlington, VA for two days of cutting-edge #DFIR insights and save 25% on your in-person registration with discount code: SponsorGuest.
Learn more and register: https://ow.ly/84Sb50ZTig7
@hasamba72.bsky.socialInfoGuard Labs published "AI Ate My Velociraptor" by Matthew Green. Explores AI integration with the Velociraptor DFIR tool. Specific findings remain unverified. #DFIR #AI #Velociraptor https://labs.infoguard.ch/posts/ai_ate_my_velociraptor/
A Windows incident rarely gives you one perfect artifact.
A practical DFIR workflow:
Collect → Analyze → Correlate → Report
Event Logs, Prefetch, Registry and MFT become far more useful when they support one timeline—not four separate investigations.
@andreadraghetti.bsky.social
@chrissanders88.bsky.socialInvestigation Scenario 🔎
Windows Defender Event ID 5007 shows DisableRealtimeMonitoring changed from 0 to 1, yet MsMpEng.exe appears to still be running.
What do you look for to investigate whether an incident occurred?
@donwebmedia.bsky.socialVeloxamen: pipeline DFIR cloud-native que deja AWS
¿Por qué un ingeniero DFIR cambió AWS y OpenSearch por BigQuery? Conocé Veloxamen, el pipeline DFIR cloud-native open source y su roadmap con Vertex AI
#dfir #bigquery #googlecloud #forensedigital #veloxamen
@cl0qsearch.bsky.socialThreat hunting tip: cl0q has 25.6M favicons fingerprinted by SHA-256. Click any icon and it finds every site serving that exact icon, which is perfect for mapping phishing kits and C2 infrastructure. cl0q.com/explore #ThreatIntel #DFIR
@javimosch.bsky.social🔌 dfir-toolkit: CLI tools for forensic investigation of Windows artifacts 📦 https://github.com/dfir-dd/dfir-toolkit 🔗 https://github.com/javimosch/supercli #dfir-toolkit #supercli
@abrignoni.comqnxprobe v1.50 recovers deleted files off YAFFS2, JFFS2 and UBIFS flash, opens BitLocker and encrypted APFS with a password, and opens E01, AFF4, .dmg and VMDK directly.
@infosecbot.bsky.social"We've seen these threat actors get blocked by Defender and then minutes later Defender Control gets copied over and run."
Read the full report:
https://
buff.ly/XzGRWVr
#DFIR #ThreatIntel
— from @TheDFIRReport (https://x.com/TheDFIRReport/status/2104624760663445870)
@stark4n6.bsky.socialDigital Forensics Now Podcast - S3 - 8 #DFIR www.youtube.com/live/Ji3bsWj...
@magnetforensics.bsky.socialOur latest blog explores how #DigitalForensics strengthens response to #Ransomware, business email compromise (BEC), data breaches, and threat hunting by preserving the evidence needed to drive better decisions.
Read more: https://ow.ly/snHK50ZRCqh #DFIR
@infosecbot.bsky.social"The privilege escalation tool the threat actors brought with them was written as a text file and then decoded using certutil into a binary file."
Read the full report:
https://
buff.ly/DL3KZOC
#DFIR #ThreatIntel
— from @TheDFIRReport (https://x.com/TheDFIRReport/status/2104307620576157993)
@phillmoore.bsky.socialWeek 39 - 2026 #DFIR
@abrignoni.comDeleting a file on flash does not erase it. The pages stay until garbage collection gets to the block.
qnxprobe recovers deleted files from YAFFS2, JFFS2 and UBIFS. On a real Android dump: 1,945 deleted, 1,924 complete, 149 of 150 checked byte for byte.
@abrignoni.comNew LEAPP in the family: GLEAPP 🖼️🎞️ Image and video triage. Hashing, visual de-dup, EXIF and GPS, video key frames, known-hash matching and a review gallery. By Heather Charpentier. Free and open source.
@magnetforensics.bsky.socialKnow an agency making a real impact in #DigitalInvestigations?
The Agency Impact Award nominations are now open!
Help us recognize the teams driving innovation, advancing investigations, and making a difference in their communities.
Learn more: https://ow.ly/hPXp50ZRbGr #DFIR
