DFIR BlueTeam Github: https://github.com/00010111 Not representing my employer (past & present).https://bsky.app/profile/b00010111.bsky.socialhttps://bsky.app/profile/b00010111.bsky.social/post/3mimglt5tvq2oBrowser-based tool for parsing, analyzing, and triaging FortiGate firewall CSV log files. https://github.com/M4shl3/FORTIDFIR #DFIR03 Apr 2026 19:15 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3mimglt5tvq2ohttps://bsky.app/profile/b00010111.bsky.social/post/3mil4brc6w22jlikely already posted by others, but still relevant Potential hardening options for npm: npm has an option to ignore scripts: ignore-scripts npm (since cli version 11) has an option to set a minimum release age: min-release-age Full official documentation: https://docs.npmjs.com/cli/v11/using-npm/config03 Apr 2026 06:38 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3mil4brc6w22jhttps://bsky.app/profile/b00010111.bsky.social/post/3mhrwy3hzox2kDebugging - WinDBG & WinDBGX Fundamentals by @corelanc0d3r.bsky.social https://www.corelan.be/index.php/2026/03/23/debugging-windbg-windbgx-fundamentals/24 Mar 2026 06:26 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3mhrwy3hzox2khttps://bsky.app/profile/b00010111.bsky.social/post/3mgfykfmu772w"Linux Notes: ls and Timestamps" Some nice hints in there to ease usage of ls. #linux https://righteousit.com/2026/03/06/linux-notes-ls-and-timestamps/06 Mar 2026 18:57 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3mgfykfmu772whttps://bsky.app/profile/b00010111.bsky.social/post/3mf6xm5ikbg25Overview on Google workspace audit logs by invictus IR: https://www.linkedin.com/posts/invictus-incident-response_stayinvictus-cloudincidentresponse-google-activity-7429842194682925056-kHcE #DFIR #Blueteam19 Feb 2026 06:26 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3mf6xm5ikbg25https://bsky.app/profile/b00010111.bsky.social/post/3mezwnteesg2q"Trust Me, I’m a Shortcut", nice blog about windows .LNK files. https://www.wietzebeukema.nl/blog/trust-me-im-a-shortcut #DFIR #Blueteam17 Feb 2026 06:26 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3mezwnteesg2qhttps://bsky.app/profile/b00010111.bsky.social/post/3mejuqdagqa25A community database, API and collaboration platform to help identify and protect against open-source malware -> opensourcemalware.com #DFIR #blueteam https://opensourcemalware.com/10 Feb 2026 21:09 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3mejuqdagqa25https://bsky.app/profile/b00010111.bsky.social/post/3mbrux6m5zd2fsamplepedia.cc New, free resource for malware samples to experiment and train. #dfir https://samplepedia.cc/06 Jan 2026 21:19 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3mbrux6m5zd2fhttps://bsky.app/profile/b00010111.bsky.social/post/3mabvquwrrc2bStrange, I cannot create a post in bluesky which contains a URL via @openvibe@mastodon.social . Not sure what is causing this.18 Dec 2025 19:25 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3mabvquwrrc2bhttps://bsky.app/profile/b00010111.bsky.social/post/3mabrnsrgpz2eTest to check if bluesky is still working18 Dec 2025 18:12 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3mabrnsrgpz2ehttps://bsky.app/profile/b00010111.bsky.social/post/3m6bzxppb2z26An ESXi IR guide, probably worth a read: https://mikecybersec.notion.site/ESXi-IR-Guide-0ffbcec7272244d6b10dba4f4d16a7c8?pvs=74 #DFIR #Blueteam23 Nov 2025 09:50 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3m6bzxppb2z26https://bsky.app/profile/b00010111.bsky.social/post/3m2lw3xcvdq23Adaptive Collections in Velociraptor: https://docs.velociraptor.app/blog/2025/2025-09-28-adaptive-collections/ #DFIR07 Oct 2025 10:27 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3m2lw3xcvdq23https://bsky.app/profile/b00010111.bsky.social/post/3m25dsg5ekc22https://blog.digital-forensics.it/2025/09/exploring-data-extraction-from-ios.html01 Oct 2025 15:22 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3m25dsg5ekc22https://bsky.app/profile/b00010111.bsky.social/post/3lvsdddcdxf2l"A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes" #dfir # eventlogs https://github.com/olafhartong/BamboozlEDR07 Aug 2025 08:34 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3lvsdddcdxf2lhttps://bsky.app/profile/b00010111.bsky.social/post/3lv3s73cdfh22Medusa stealth rootkit on Linux and how to work around and investigate this style of LD_PRELOAD rootkit: https://www.linkedin.com/posts/craighrowland_i-wrote-up-a-quick-article-on-the-medusa-activity-7355100371830132736-CMcb #dfir #linux29 Jul 2025 09:29 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3lv3s73cdfh22https://bsky.app/profile/b00010111.bsky.social/post/3luhjkwet6i2qhttps://github.com/Neo23x0/signature-base/blob/master/yara/expl_sharepoint_jul25.yar #CVE-2025-5377021 Jul 2025 08:01 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3luhjkwet6i2qhttps://bsky.app/profile/b00010111.bsky.social/post/3lu7q7ay4h324Hiding Payloads in Linux Extended File Attributes https://isc.sans.edu/diary/Hiding+Payloads+in+Linux+Extended+File+Attributes/32116 #DFIR #linux18 Jul 2025 05:38 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3lu7q7ay4h324https://bsky.app/profile/b00010111.bsky.social/post/3ltolgwdrbi2lshodan@mastodon.shodan.io: "Check out our new Data Status page for an overview of what Shodan crawlers have collected the past day: data-status.shodan.io " I still in the process to decide which stats do frighten me the most.....11 Jul 2025 09:58 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3ltolgwdrbi2lhttps://bsky.app/profile/b00010111.bsky.social/post/3ls7ogumhia27Offline webshell scanning tool, based on YARA rules https://github.com/ekky19/Yara-Standalone-Webshell-Scanner #DFIR #yara #webshell22 Jun 2025 18:16 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3ls7ogumhia27https://bsky.app/profile/b00010111.bsky.social/post/3lqr6z5tdr62bWindows Registry Forensics Cheat Sheet 2025 by Cyber Triage. Potentially worth a look to check your docu against it. https://www.cybertriage.com/blog/windows-registry-forensics-cheat-sheet-2025/ #DFIR #Registry04 Jun 2025 06:38 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3lqr6z5tdr62bhttps://bsky.app/profile/b00010111.bsky.social/post/3lqopvmk3li2tTool for triage & analysis of ESXi logs: - Combined timeline of Bash activity, logons and user activity - Timeline of logon events by type, along with a user/IP logon timeline - Summary of Bash history, network-tool usage and newly created users https://github.com/cudeso/tools/tree/master/qelp-ir-triage-esxi #DFIR #Logs #esxi03 Jun 2025 07:02 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3lqopvmk3li2thttps://bsky.app/profile/b00010111.bsky.social/post/3lojlt6askq2f"iOS Unified Logs: The Myth of 30 Days Retention - Analysis of TTLs and log stats Command" -> https://www.ios-unifiedlogs.com/post/ios-unified-logs-the-myth-of-30days-retention #DFIR #iOS #logs06 May 2025 19:15 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3lojlt6askq2fhttps://bsky.app/profile/b00010111.bsky.social/post/3lo6mx5wei52mCensys on C2 server called the “SCOUT PROJECT,” https://censys.com/blog/scouting-a-threat-actor #DFIR02 May 2025 10:36 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3lo6mx5wei52mhttps://bsky.app/profile/b00010111.bsky.social/post/3lnj2pxuwlj2t"The Impact of Microsoft’s ReFS on DFIR" -> comparing NTFS evidences with ReFS. What stays, what changes and what will be gone. Recommended read! https://medium.com/@mathias.fuchs/the-impact-of-microsofts-refs-on-dfir-cdb78f401bfd #DFIR #ReFS #NTFS #FileSystems23 Apr 2025 20:44 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3lnj2pxuwlj2thttps://bsky.app/profile/b00010111.bsky.social/post/3lmmj3vvndr2vSounds very handy: "Mounting disk images (E01 or raw) Handling LVM volumes Automatically identifying and mounting partitions ... All mount operations are performed read-only, with noexec and other conservative options to preserve evidence integrity." https://www.hecfblog.com/2025/04/daily-blog-805-mount-that-thing.html?m=1 #DFIR #Linux12 Apr 2025 12:14 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3lmmj3vvndr2vhttps://bsky.app/profile/b00010111.bsky.social/post/3llnwrm33662jNext noteworthy #breach incoming? Reading some chatter that there are claims of #checkpoint being breached by #coreinjection . #dfir #threatintel 31 Mar 2025 08:26 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3llnwrm33662jhttps://bsky.app/profile/b00010111.bsky.social/post/3llg2r27hop2mDetect suspicious foci token logins: The in cluded description includes an explanation what foci tokens are and why a hunt might be useful. Nice work! https://github.com/HybridBrothers/Hunting-Queries-Detection-Rules/blob/main/Entra%20ID/DetectSuspiciousFociTokenLogins.md #DFIR #BlueTeam #KQL28 Mar 2025 05:16 +0000at://did:plc:5jcgixt7x3xeeldnmujkh77z/app.bsky.feed.post/3llg2r27hop2m