PowerShell as an Acquisition Engine
# PowerShell as an Acquisition Engine PowerShell is described in Hosmer's book as a powerful **acquisition engine** for digital investigations. Its role is to gather raw informat…
#incident-response
4 published notes
Why Malware Names Are Not Enough
The opening of *Practical Malware Analysis* presents a cautionary incident-response scenario: a network is breached, antivirus identifies the malware as **TROJ.snapAK**, the respo…
Malware Analysis: Role and Value of the Analyst
# Malware Analysis **Malware analysis** is the process of dissecting malicious software to understand how it works, how to identify it, and how to defeat or eliminate it. It is a…
Live Breach
A **live breach** is an active, ongoing security incident in which an attacker is currently connected to or operating inside a network while the investigative response is underway…