13 21 290
github.com
GitHub - ufrisk/MemProcFS: MemProcFS
MemProcFS. Contribute to ufrisk/MemProcFS development by creating an account on GitHub.
Bluesky · Hashtag
#DFIR
79
posts · 30d
31
users
3
posts / day
2.5
posts / user
-11% vs last week
#DFIR is an active hashtag on Bluesky. In the last 30 days, 31 people shared 79 posts with it — around 3 a day. Activity is down 11% versus the previous week, peaking on Jul 28 with 6 posts.
#DFIR posts per day (last 30 days)
Related tags
Tags most often used together with #DFIR.
Posts with #DFIR
🚀 Excited to announce the alpha release of NIMS - a Notion-based Incident Management System!
Designed for SOC/IR teams, NIMS helps streamline incident management and collaboration using Notion's powerful database features.
#InfoSec #DFIR #IncidentResponse #SecOps #Notion
4 21 73
6 10 62
MemProcFS is a GREAT Memory Forensics tool. Sharing here in case you have not checked this before! #DFIR #MemoryForensics #MemProcFS
github.com/ufrisk/MemPr...
1 8 39
Happy New Year! I partnered with @13cubed.bsky.social for a giveaway of his XPlat training/certification Bundle!
To Enter: Like, Repost, and Leave a Comment
On January 12th, 1 winner will be chosen from LinkedIn and 1 winner will be chosen from Bluesky.
#DFIR #DigitalForensics #IncidentResponse
32 32 38
If you're interested in Linux DFIR? Then check all our talks/workshops below. #Linux #DFIR #Cybersecurity
CC: @maryst33d.bsky.social
linuxdfir.ashemery.com
0 14 38
My latest, on the more unusual IR cases we see in the industrial space. www.dragos.com/blog/the-shi... #ICSSecurity #DFIR #cybersecurity
www.dragos.com
0 7 38
@volexity.com recently identified multiple Russian threat actors targeting users via #socialengineering + #spearphishing campaigns with Microsoft 365 Device Code authentication (a well-known technique) with alarming success: www.volexity.com/blog/202….
#dfir #threatintel #m365security
www.volexity.com
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication
Starting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack cam...
2 18 32
As a result, the CISO positioned a global password reset. In large orgs that is a complex and difficult task that will disrupt normal operations.
So yeah, I got yelled at by a business VP and blamed for the cost/impact of incident because I found it.
VP: "WHY WHERE YOU EVEN LOOKING?" 2/2 #DFIR
media.tenor.com
a man in a suit says that 's my job netflix
Alt: a man in a suit says "that 's my job"
4 0 34
New #Bluesky #Android parser in #ALEAPP preview.
💬 Parses messages, actors, feed, and follows.
⏰ Hope to be done with most before Thursday's Digital Forensics Now Podcast stream (@dfnpodcast.bsky.social)
#DigitalForensics #MobileForensics #DFIR #WillDemoLiveOnStream
3 8 33
A thing that still blows me away about #DFIR work is how otherwise-experienced IT folks think it's highly automated.
"Oh you just need to run some scans, right?"
No.
5 4 33
A decent version of most #DFIR software can now be made at home, in a few hours, by someone who does not code.
So what makes anyone an expert now? Five qualities, and "has access to #AI" is not one.
leapps.org/blog-post?po...
leapps.org
Using AI Effectively in Digital Forensics — LEAPPs Blog
A decent version of most digital forensics software can now be made at home, in a few hours, by a user that does not code. What does that mean for vendors and for us as users, and what actually makes ...
0 0 0
🔍 Where is enterprise DFIR heading next? @magnetforensics.bsky.social wants the practitioner view.
Take their annual State of Enterprise DFIR survey to help benchmark the field and shape one of the industry's leading DFIR reports.
🔗 Take the survey: buff.ly/naW9l08
#EDRM #TrustedPartner #DFIR
sw2.decipherinc.com
State of Enterprise DFIR Survey
Contribute to the State of Enterprise DFIR Report, which highlights the opportunities, challenges, and trends shaping digital forensics and incident response today, shaped by insights from professionals like you.
0 1 1
Golang wrapper for Volatility3 runs a newline-delimited list of memory forensic plugins in parallel using up to 15 goroutines, outputting CSVs to a specified directory. Sorts by longest runtime. #DFIR #Volatility3 #tool github.com/BeanBagKing/Vo…
0 0 0
We're here at #BlackHatUSA 2026!
Stop by Booth 8406 in the #AI Zone Pavilion to meet the team, see our latest innovations in action and chat about the #DigitalInvestigations challenges facing today's #DFIR & #Cybersecurity teams.
Plus, visit us for a chance to win a VR headset!
0 0 0
Read the latest DFIR news - Android 16 intrusion logging, forensic observability for network devices, mental health support gaps for investigators, GrapheneOS duress passwords, privacy app artifacts, and more. www.forensicfocus.com/news/... #DigitalForensics #DFIR
0 0 0
New cheatsheets pushed
github.com/r1cksec/chea...
#infosec #cybersecurity #redteam #pentest #threatintel #malware #dfir #bugbounty #opensource
github.com
GitHub - r1cksec/cheatsheets: Collection of knowledge about information security
Collection of knowledge about information security - r1cksec/cheatsheets
0 0 2
📱 Telegram: 15 new artifacts across iLEAPP and ALEAPP, plus a cross-platform system events reference.
⚠️ No settings key does not mean "off." It means the app default applied. Printing "off" invents evidence.
leapps.org/blog-post?post…
#DFIR
0 1 0
Agent runtimes invert host forensics: no disk, no kernel, no persistence. Evidence sits in vendor SQLite tables and gateway logs, deleted in 72 hours by default. 17,600 actions recovered from one 2026 intrusion. #DFIR #AI #IncidentResponse www.ionsec.io/resources/a…
0 0 0
📱 Eight years after my Android UsageStats posts, the XML became protobuf, 4 event types became 32, and ALEAPP now parses all of it.
⚠️ ACTIVITY_RESUMED is not "the user tapped the app." It is a lifecycle state.
leapps.org/blog-post?post…
#DFIR
leapps.org
Every Step You Take, Eight Years Later: Android UsageStats and Recent Tasks — LEAPPs Blog
Android's pattern-of-life evidence grew from readable XML into tokenized protobufs carrying app lifecycle, lock state, notifications, services, task roots, and more. We went back to the source, update...
0 0 1
New blog on decoding modern Conversation Index values for email forensics: www.metaspike.com/convers…. #DFIR #eDiscovery
www.metaspike.com
Conversation Index Analysis in Email Forensics — Part 2
Usage of Conversation Index metadata in email forensics and calculation of child block timestamps in modern thread indices that wrap.
0 0 1
Have you seen any evidence of the famous « collect encrypt data and decrypt later » in incident response ?
Until now, I haven’t.
#pqc #crypto #cryptography #dfir
1 1 0
Posts are pulled live from Bluesky and cached briefly. Posts with content labels are hidden.