⛵️Join me on the waterfront in San Diego for FOR518! ⚓️ 💻New dataset with macOS 15 and iOS 18!📱 📄New workbook with 20+ NEW labs! 🧩New CTF Day 6 Challenges! 📱Updated Corellium devices! Find out more here: sans.org/for518

Join me in one of my favorite places for the updated FOR577. Now, with more BTRFS, more rootkits, and more Linux attacks. #FOR577 #SANSSecWest SANS DFIR

🤠Join me in Dallas (Virtual or In Person) for the first run of the newly updated FOR518! 🐴 💻New dataset with macOS 15 and iOS 18!📱 📄New workbook with 20+ NEW labs! 🧩New CTF Day 6 Challenges!🧩 📱Updated @CorrelliumHQ devices! 🍖…and hopefully good BBQ and Tacos!🌮 Find

Tool update: sigs.py - added check mode isc.sans.edu/diary/31706

Tool update: mac-robber.py isc.sans.edu/diary/31738

🚨 THIS JUST IN: The ultimate #Linux guide is here! Created by Kathryn Hedley & Taz Wake this must-have forensic poster is your go-to resource for detecting rootkits, tracking attacker persistence, & analyzing timestamps. 📄 Get your FREE copy! buff.ly/pl8eiHo #DFIR

Yet again, I remind you that if you work in cybersecurity, you will never not benefit from learning packet analysis. Yes, there are tools for that. But when they fail (and oh buddy do they fail), your ability to perform independent analysis is critical.

Blog post: x64dbg.com/blog/2025/03/0… Check out Darius Houle's website: x64.ooo x64dbg Automate: dariushoule.github.io/x64dbg-automat…

📄 The Linux #IncidentResponse & #ThreatHunting Poster by Kathryn Hedley & Taz Wake is your forensic roadmap, helping you analyze timestamps, track persistence mechanisms, & uncover hidden malware. 📥 Download your FREE copy!: sans.org/u/1Avg #DFIR #Linux

Have you checked out the new hunting tool yet? We may have mentioned it once or twice already! 😂 And, here it is again!  🔎 Just enter an IPv4, domain, URL, or file hash, and instantly see if it’s been identified on URLhaus, MalwareBazaar, ThreatFox, or YARAify - with just one

📄 In case you haven't grabbed your copy... The #CTI Cheat Sheet v1.0 created by Katie Nickels & @PDXBek simplifies threat modeling, tackles cognitive biases, & sharpens your analysis. 📥 Grab your FREE copy: buff.ly/7sAn10C #ThreatIntel #DFIR

Linux touches every part of our networks. Our routers, switches, and firewalls likely run some flavor of Linux or Unix. Join me in London in July for the newly updated #SANS #FOR577 where we'll learn how to investigate attacks on Linux systems. sans.org/cyber-security…

DFIR Bytes isn’t a CTF or a workshop—it’s a fully immersive case-solving experience. You’ll tackle real-world incidents, apply forensic techniques, & build skills you can use immediately. Only at #DFIRSummit in Salt Lake City this July w/ Kathryn Hedley! 🔗 sans.org/u/1zv0

🏔️ Join the top minds in digital forensics & incident response at the SANS #DFIRSummit in Salt Like City on July 24-25 for: 🎤 2 days of expert talks 💻 DFIR Bytes 🛠️ Hands-on workshops 👥 Unmatched networking 🎓 Earn 12 CPEs (6/day) ➡️ Explore Agenda: sans.org/u/1zv0

Join us at #DFIRSummit in July when Jessica Gorman shares how modular design can streamline IR playbooks — saving time, cutting errors, & scaling updates across dozens (or hundreds) of workflows. ➡️ View Agenda & Register: sans.org/u/1zv0 #IncidentResponse #SOAR

YOU MANIACS! YOU BLEW IT UP! theatlantic.com/magazine/archi…

hashcat v7.0.0 released! After nearly 3 years of development and over 900,000 lines of code changed, this is easily the largest release we have ever had. Detailed writeup is available here: hashcat.net/forum/thread-1…

hashcat v7.1.0 released! This update includes important bug fixes, new features, and support for new hash-modes, including KeePass with Argon2. Read the full write-up here: hashcat.net/forum/thread-1…

We should really all be retweeting this daily.

2 more days to get the early-bird discount for one of my all-time favorite conferences, #SANS #DFIRCON in Miami in Nov. There are a bunch of hands-on workshops on Sun, 16 Nov, lots of evening events during the week #FOR577 my last in 2025. SANS DFIR sans.org/cyber-security…