Posts
-
Improving AFD Socket Visibility for Windows Forensics & Troubleshooting
-
Introducing the Restart Manager Artifacts Tool
-
On System Reliability or Why the (Conceptual) Design of the Blue Screen on Windows Is Good
-
Reconstructing Executables Part 1: Between Files and Memory
-
The Definitive Guide to Process Cloning on Windows
-
Bypassing FileBlockExecutable in Sysmon 14.0: A Lesson In Analyzing Assumptions
-
Concealed Code Execution, Part 3: Detection.
-
Concealed Code Execution, Part 2: Code Injection.
-
Concealed Code Execution, Part 1: Process Tampering.
-
Comparing, Discussing, and Bypassing Techniques for Suspending Processes.
-
Intercepting Program Startup on Windows and Trying to Not Mess Things Up.
-
How to Make Any Process Work With Transactional NTFS: My First Step to Writing a Sandbox for Windows.
subscribe via RSS