August 2021
07
Microsoft Paint: Kernel Mode vs. User Mode
No Comments
In this blog post, I test how much time Microsoft Paint spends in kernel mode versus user mode.
December 2020
20
Threat Hunting via Windows Event Logs with DeepBlueCLI
In this blog post, I will use the PowerShell module DeepBlueCLI to quickly discover suspicious account and command line behavior by parsing some sample evtx files from DeepBlueCLI GitHub page.
December 2020
19
Endpoint Live Forensics from the Command Line on Windows
In this blog post, I will provide an introduction of how to do live forensics on a Windows machine by using default command line tools.