Half of threat hunters say bad data is their biggest problem

📖 Read more: www.helpnetsecurity.com/2026/09/25/s...

#cybersecurity #cybersecuritynews #threathunting #infosec #SOC #DFIR @sansinstitute.bsky.social

Trying to find a case involving Xbox forensics. Here's a summary (generated by #ai from my prompts).

I just can't recall where I read about it. :(

#dfir #research

I was doing some research on #dfir ... and run across a story from 2008 -> techcrunch.com/2008/01/30/m...

What? Just what?

He was convicted -> 6abc.com/archive/5913...

In his latest blog, Chad Gish outlines seven common pitfalls facing #DigitalForensics programs today and shares practical ways to build stronger teams, reduce backlogs, adapt to change, and uncover critical evidence faster.

Read more: https://ow.ly/vIaW50ZR7qL #DFIR

~Spiderlabs~
File retrieval via Graph or scripts may log as FileAccessed, not FileDownloaded.
-
IOCs: ShinyHunters, PEAR, HELIX
-
#DFIR #M365 #ThreatIntel

Tools can make you a better analyst, but you have to be metacognitively aware enough to know where they fit in, where they have limits, and where it all might lead you astray.

#DFIR #SOC #CyberSecurity

@brettshavers.bsky.social - Everyone Suddenly Knew Oxygen Forensics Was Guilty #dfir

Links to public sources and downloads in this case, including a visual timeline are on brettshavers.com/everyone-sud...

[ #dfir ] Developments on Oxygen Forensics and arrests.

Tech CEO, Russian National Arrested on Complaint Alleging They Hid Russian Ownership and Development of Software Sold to U.S. Government - www.justice.gov/usao-cdca/pr...

Finding evidence isn't the challenge. Finding the evidence that matters is.

See how Magnet #Axiom Premier + Magnet #Griffeye Advanced help investigators reduce manual review, analyze more media, and uncover critical evidence faster.

Read the blog: https://ow.ly/lKLb50ZQKC5 #DFIR

RE: https://infosec.exchange/@tazwake/117321231170069103

#Dfir #Incidentresponse

Cybercrime is a $10T economy. The cybersecurity industry fighting it is a fraction of that size. In this blog and video, former FBI Supervisory Special Agent Miguel Clarke shares why organizations need to invest more in recovery and forensic readiness: ow.ly/mbbA50ZQzZZ #DFIR

Investigation Scenario 🔎

Event ID 5136 on a DC shows msDS-KeyCredentialLink was modified on an old service account. No password reset occurred.

What do you examine next to determine who added the credential and whether it was used?

#InvestigationPath #DFIR #SOC

"They then inspected the documents they collected prior to exfiltrating them over to Mega storage servers using the Rclone application."

Read the full report:
https://
buff.ly/9SUamWk

#DFIR #ThreatIntel

— from @TheDFIRReport (https://x.com/TheDFIRReport/status/2102443325487759768)

Among many who embrace it, that's leading to greater metacognitive awareness... people becoming more conscious of how they reason, not just what conclusions they reach.

#DFIR #AI #LLM #Metacognition

Day 1 at #NWICAC is in the books! Great conversations at our booth, Justin Fitzsimmons sharing legal insights, Darryl Judge speaking at the opening plenary, and a special visit from ESD K9 Chewie 🐕‍🦺. Proud to be a Titanium Sponsor. #ICAC #DFIR

Respuesta a incidentes en 7 pasos:

1. Detectar
2. Escalar
3. Contener
4. Evidencia forense
5. Erradicar
6. Notificar dirección
7. Recuperar + monitorizar 72h

¿Tu equipo lo tiene ensayado?

#IncidentResponse #CyberSecurity #SOC #DFIR

Volatility New Release: #volatility3 v2.28.2 - visit github.com/volatilityfo... for details and downloads.

#memoryforensics #dfir

In this webinar, discover how event-driven collections can help your team:

✅ Reduce response times
✅ Preserve critical evidence automatically
✅ Eliminate manual collection processes
✅ Streamline hybrid #DFIR workflows

Sept. 23 | Register here: https://ow.ly/QApj50ZPGkw #DFIR

I found www.elastic.co/security-lab... interesting for a few reasons:
- the install vector for the malicious browser extension is pretty neat, and
- the "customer id" is a UUIDv1 and Unfurl can extract the timestamp

Unfurl on the download URL: hindsig.ht/unfurl/?url=...

#DFIR #Malware #BF4SA

"The unsigned DLL, with descriptor Cancel Autoplay 2 was executed using regsvr32.exe"

Read the full report:
https://
buff.ly/3xlWb5b

#DFIR #ThreatIntel

— from @TheDFIRReport (https://x.com/TheDFIRReport/status/2101786020790362339)