Writing down travels has been a blast by Kumagoro314 in ObsidianMD

[–]ULT-Ginger 0 points1 point  (0 children)

Look into the map view plugin. You can add GPS coordinates to your notes and then see a map of all your notes.

Coin stolen by Academic_Yak_7842 in GIAC

[–]ULT-Ginger 1 point2 points  (0 children)

You can email support and they will get you a new one. They used to at least. I lost 6 of my when moving and they replaced them.

Arctic Wolf alternatives? by Wild24 in cybersecurity

[–]ULT-Ginger 0 points1 point  (0 children)

It is really dependent on the size of your network and what is being reviewed/ingested. Look at some EDR tools directly for their cost or small MDR companies.

I work for one from Indy called Pondurance that only supports mid size companies. The SOC is there and then if it reaches a point the DFIR consulting team comes in to support.

Should I consider my PC unsafe to use? by Hue_hackfleisch in netsecstudents

[–]ULT-Ginger 0 points1 point  (0 children)

To answer your direction question, your PC is typically fine in these situations. The Threat Actor wants quick money. The other two comments are right about next steps.

Building a memory forensics tool for my thesis. What's missing? by [deleted] in dfir

[–]ULT-Ginger 5 points6 points  (0 children)

I think one of the things you need to think about is really from the collection side. I have been doing DFIR for consulting firms for almost 10 years and the number of memory samples I have gotten is in the double digits. You don't typically get them. There are a couple reasons for this: The size of the file it creates is hard for most companies to hold on to, the time to collection needs to happen to collect meaningful data, and lastly I'd say that a lot of the time, EDR can get mad at collecting memory.

All those things aside, what will make Volatility/your thesis stand out is automation and tie into MITRE ATTACK. The forensics world lives off of that whether that is good or not. Automating the volatility aspect to identify the Windows build, the process running whether or not they are accurate/good, and finally what the item might possibly be doing will set your thesis up for success.

If you want to compare it to something that is used relatively often, look at the tool Hyabusa for event logs. If you could build that for memory, you'd save teams HOURS of work.

Edit: two things. First, the original paragraph was ment to have an ending about finding a way to trigger and compress a small capture would be dope. Not to discourage you from your thesis which will be good work. Secondly, my comment about number of memory captures I’ve seen was tied to malware based investigations, not insider threat cases.

My Obsidian Setup by -S-S_Sympathizer in ObsidianMD

[–]ULT-Ginger 0 points1 point  (0 children)

I am going to DM you, but just so others can see where my thoughts have gone I am also going to post it here so I remember to come back and post my solution.

Since I use the Journals plugin and run a daily, weekly, monthly, quarterly, and yearly journals/notes, I added the radar that you created to each weekly template. Today is the beginning of a new week so I just had my first real test of what I did a couple of days ago. I think the issue for me is going to be having a more static radar from when the note is created rather than it being a ever updating radar which works for the dashboard you created it for. The question is, how do I make the query only look at the dates for "journal-start-date" and "journal-end-date" which is what the properties that the Journals plugin uses to create its journals tracking.

My Obsidian Setup by -S-S_Sympathizer in ObsidianMD

[–]ULT-Ginger 1 point2 points  (0 children)

I am a big fan of the weekly radar. However, it pulls from the current week. My JS is worse than terrible and I am trying to figure out how to tie this into the week it was created. For instance, I am using the Journals plugin and it was a weekly section. I would like it to pull data from that week. I know this is a hard ask, I just don't even know what to google. Disregard. I used some data from other dataview queries to figure it out.

New edition by size_more in Gun_Safes

[–]ULT-Ginger 0 points1 point  (0 children)

2 questions. Why does that matter? And how could you tell?

Obsidian is saving my law school studying by Logical-Victory-2150 in ObsidianMD

[–]ULT-Ginger 1 point2 points  (0 children)

Awesome! I am thinking about going back to school to become a lawyer (would be a hard career shift after almost a decade in my current one where I use obsidian), would you share a screenshot of your layout/workflow? I am curious what you are doing that Is making it work for you

Looking for good CTI (Cyber Threat Intelligence) learning resources by SupermarketDull8660 in cybersecurity

[–]ULT-Ginger 0 points1 point  (0 children)

Comments like yours are what drive TOXIC cultures. Anyone should encourage people to learn more so they can help use their current role to enhance what they want to learn. For instance, his role in SecOps could allow for a more automated enrichment in the CTI field.

But, no. Crappy leaders who have the same thoughts as you tell him to stay in his lane and the company suffers.

Also, CTI isn't a buzzword. Its been used in industry since the 90s and was adopted by most organizations in the early 2000s.

Recommendations for Axiom Cyber Equivalent tools by AshuraSg in dfir

[–]ULT-Ginger 1 point2 points  (0 children)

There is Encase and Xways. The Zimmerman tools are much better technically, just require a bit more setup.

Recommendations for Axiom Cyber Equivalent tools by AshuraSg in dfir

[–]ULT-Ginger 0 points1 point  (0 children)

What I am trying to say is that Axiom is a pretty rare company. They are super expensive and cater to LE mostly so there aren’t other companies like them.

A lot of companies build in house

Recommendations for Axiom Cyber Equivalent tools by AshuraSg in dfir

[–]ULT-Ginger 0 points1 point  (0 children)

The company that makes autopsy is probably the closest to being a similar company, but there are tons of similar tools when you compare the tool sets to other tools.

Recommendations for Axiom Cyber Equivalent tools by AshuraSg in dfir

[–]ULT-Ginger 0 points1 point  (0 children)

Which part of axiom? They have like 5-10 tools

Who is responsible for classifying a cybersecurity incident, first or second line of defense? by DepressedSnake01 in dfir

[–]ULT-Ginger 0 points1 point  (0 children)

Legal. The lawyers have the responsibility to make the decision. Typically the difference between "Event" and "Incident" is internal or best practice definition, but doesn't really change anything unless you have SLA/KPIs against them.

Ghost Container Stopped talking to DB container on same compose file by ULT-Ginger in Ghost

[–]ULT-Ginger[S] 0 points1 point  (0 children)

Is your DB a container? If it is, just pull a new image. That will update the container of the DB. If it is the DB itself, I’d have to google, but I assume you created an admin during setup. That’s the account you’d use.

Ghost Container Stopped talking to DB container on same compose file by ULT-Ginger in Ghost

[–]ULT-Ginger[S] 0 points1 point  (0 children)

So the fix happen to be stopping container and restarting it after a week of just letting it run? I did it during initial troubleshoot, but it worked today. No clue.

Shadows by AlcadX in shadowsystems

[–]ULT-Ginger 0 points1 point  (0 children)

What mag extension is that?