A while back, I discussed how memory could be used as an ultimate form of the log as long as the analysis workflow and process is smooth. This blog post will start by explaining the blind spots created by event-driven detection solutions such as Endpoint Detection & Response (EDR), and how this can be balanced by using Comae DumpIt + Stardust as part of an incident response & compromise assessment strategy.

Going beyond log files, accepting memory as its own format. 🔗 Logging is a common practice for IT and Security purposes. Mature organizations tend to have extensive and in-depth logging capabilities using either commercial or free solutions. Although, logging is a powerful way to troubleshoot and investigate events it’s often limited by the initial input format of the logs during the collection process. As the complexity of attacks increase, it’s almost natural for defensive capabilities to also evolve — particularly in the logging capabilities area. Seasoned attackers focus their operational efforts on advanced infiltration techniques but also on anti-forensics techniques to erase evidences of their visits as we have seen in the some of the files leaked by TheShadowBrokers last year.

What languages I’ll keep a close look at next year (2018) If “crypto” stands for cryptography… then, is my auto-correct right to call “cryptocurrencies” just “currencies”? Cryptocurrencies and blockchain made a lot of noise this year, good and bad. Smart contracts are finding new use cases (e.g. CryptoKitties), and some existing use case like multi-sig wallets (e.g. Parity) have been challenged due to their high complexity which introduced, like any piece of complex software, security vulnerabilities.