Video & Animation

Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX

Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast), and staging URL patterns. Use when hunting for or confirming Empire C2 activity in Windows event logs.

Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, confirming whether a suspicious binary ran, or correlating execution evidence with other forensic artifacts during an investigation.

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect

Analyzes encryption algorithms, key management, and file encryption

Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,

Detect and analyze covert communication channels used by malware, including

Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized network reconnaissance, protocol-level forensic analysis, or building traffic anomaly detection during security testing.

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

Performs Linux memory acquisition using LiME (Linux Memory Extractor)

Analyzes network traffic generated by malware during sandbox execution

Captures and analyzes network packet data using Wireshark and tshark

Detect sandbox and VM evasion techniques in malware samples by analyzing

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing from Outlook archives.

Analyzes indicators of compromise (IOCs) including IP addresses, domains,

>-

Perform static and symbolic analysis of Solidity smart contracts using

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo

Perform static analysis of malicious PDF documents using peepdf, pdfid,

Detonate malware samples in Cuckoo Sandbox to observe runtime behavior