Reconnaissance Detection (Blue Team)
As we move through this Red Team vs. Blue Team series, our intent is to provide insight into both sides of the…
Investigating PowerShell: Command and Script Logging
PowerShell is becoming ubiquitous in the Microsoft ecosystem, and, while it simplifies administration, it opens up a nearly unprecedented suite of capabilities…
CrowdResponse Application Execution Modules Released
As the user base of CrowdResponse multiplies, we see a steady stream of requests from active users. Many use the tool for…
Registry Analysis with CrowdResponse
The third release of the free CrowdResponse incident response collection tool is now available! This time around we include plugins that facilitate the collection…
Mo’ Shells Mo’ Problems – Web Server Log Analysis
Disclaimer: CrowdStrike derived this information from investigations in unclassified environments. Since we value our clients’ privacy and interests, some data has been redacted…
Post-Snowden Forensics
It has been over six months since Edward Snowden’s unprecedented NSA leaks, and we are still a long way from being able…