@hasamba72.bsky.socialDumplyzer is an open-source, local-first memory forensics platform for Windows x64. Processes, network connections, timeline, VAD regions, and reconstructed binaries, analyzed fully offline.
#tool #DFIR #memoryforensics https://github.com/EmadAbedini/Dumplyzer
@volexity.comJoin @attrc.bsky.social, Volexity’s Director of Research, at #BSidesNYC on Oct 17 at 10AM ET (Blue Track). In “Finding Evil Fast: Windows Memory Triage with Volatility 3,” he'll share five automated checks for quickly finding malicious activity in Windows memory.
#memoryforensics #dfir #volatility
@volexity.comCatch Volexity’s Josh Duke at #BSidesNYC on Oct 17 at 5PM ET (Other Track). Josh will present “No Safe Harbor: OceanLotus and ROGUEHARBOR,” sharing details from a recent #OceanLotus campaign that used WhatsApp to target human rights organizations and deploy the ROGUEHARBOR RAT.
@stark4n6.bsky.socialWe crested over 250,000 page views on the Forensics StartMe page just recently. I'm incredibly grateful for the #DFIR community's support! startme.stark4n6.com
@chrissanders88.bsky.socialThe production VMDK still exists in its normal datastore, but it no longer exists in the referenced path.
What do you look for to investigate whether an incident occurred?
@cybercod.bsky.socialPro-tip: Hunting malware in a PCAP? Don't carve packets manually. Hit File > Export Objects > HTTP/SMB to pull dropped payloads directly out of the stream in seconds.
@marshalla99.thx.gg.ap.brid.gy@hasamba72.bsky.socialGet-NetScalerTimeline parses NetScaler VMDK images into a UFS file timeline, pulls ns.log and httpaccess logs with SHA256, flags fake pitboss heartbeats tied to log poisoning (CVE-2026-88771). #DFIR #tool #NetScaler https://github.com/LETHAL-FORENSICS/Get-NetScalerTimeline
@cyberveille-ch.bsky.social📢 Velociraptor-skills : compétences IA réutilisables pour le DFIR avec Velociraptor
📅 Publié le 28 septembre 2026 sur le blog InfoGuard Labs par Matthew Green, cet article présente la première version publique de…
🔴 vérification factuelle basse
#DFIR #Velociraptor #Cyberveille
@infosecbot.bsky.social"This single-paged document contained a picture with instructions, attempting to lure the victim into enabling macros."
Read the full report:
https://
buff.ly/LCFCbkh
#DFIR #ThreatIntel
— from @TheDFIRReport (https://x.com/TheDFIRReport/status/2106852094627995785)
@phillmoore.bsky.socialWeek 40 - 2026 #DFIR
@hasamba72.bsky.socialVelociraptor Skills repo: 8 reusable Codex skills for DFIR setup, collection, hunting, and host analysis. Multi-server support, OpenAI API integration, Claude Code compatible. #tool #dfir #velociraptor https://github.com/ig-labs/velociraptor-skills
@forrestcook.net#DFIR folks, when doing routine scheduled validation for hardware and software, how are you structuring your steps? Did you make your process in house or did you source a process externally? For dataset analysis, do you have set questions and answers to spot check?
#askingforafriend #thefriendisme
@chrissanders88.bsky.socialThe more evidence sources you understand, the larger your investigative playing field becomes. As you understand how to think, you should also be expanding the field you operate in.
@dfrws.bsky.social📅 Digital Forensics Conference - Europe 2027
The CFP deadlines are approaching! It's time to get your #DFIR research published 🚀
⏰ Title & Abstract deadline: October 2, 2026 (AoE)
More info: buff.ly/djU5p4N
Submit here: buff.ly/FzRWcex
@magnetforensics.bsky.socialWhat if Early Case Assessment started before collection? Our new eBook explores how Forensic ECA helps teams identify the right evidence earlier, improve defensibility, reduce review costs, and make smarter discovery decisions from the start: https://ow.ly/Y7CY50ZTxZX #DFIR
@cl0qsearch.bsky.social@cl0qsearch.bsky.socialManaged IR is only as good as its onboarding: if the provider hasn't mapped your environment and table-topped your runbooks, a retainer is just an expensive phone number. Scope and baselines first. #DFIR
@cl0qsearch.bsky.socialGood read. Velociraptor + AI is interesting for triage at scale, but the trust problem is real — LLMs summarizing forensic artifacts need deterministic guardrails, or you risk hallucinating evidence. #DFIR
@cl0qsearch.bsky.socialOnly 42.7% of pages send ETag or Last-Modified — the other 57% make conditional requests useless. Stale cache headers hide what's actually live, and for recon that's a blind spot. We fingerprint it across 26.1M pages: cl0q.com/explore #infosec #recon #DFIR