DFIR & threat intel.
Research, tools & practical AI.

AI Ate My Velociraptor

Main area: AI · 1,446 words · 7 min read

Introducing velociraptor-skills, reusable AI skills for case setup, collection, hunting and evidence analysis with Velociraptor.

• DFIR
• AI
• Velociraptor

Published at InfoGuard Labs ↗ (opens in a new tab)

CLRaptor: Hunting reflected assemblies with Velociraptor

Main area: Threat Hunting · 1,281 words · 7 min read

Hunt reflected .NET assemblies at scale with Velociraptor, detect CLR visibility gaps, and dump suspicious in-memory assemblies for analysis.

• Threat Hunting
• DFIR
• Velociraptor

Published at InfoGuard Labs ↗ (opens in a new tab)

Finding the LNK: Techniques and methodology for advanced analysis

Main area: DFIR · 1,684 words · 8 min read

Advanced LNK analysis with Velociraptor, covering shortcut structures, suspicious fields, and useful clustering points for DFIR and CTI workflows.

• DFIR
• Threat Intel
• Velociraptor

Published at Rapid7 ↗ (opens in a new tab)

Kimsuky's Phishing and Payload Tactics

Main area: Threat Intel · 18-page PDF · 3,376 words · 17 min read

My 2024 Rapid7 research with Natalie Zargarov and Anna Širokova on Kimsuky’s social engineering, delivery methods and payloads.

• Threat Intel
• Kimsuky
• Phishing
• Malware

Report at Rapid7 (PDF) ↗ (opens in a new tab) · Read illustrated overview