Archives
All the articles I've archived.
- cloud forensics tooling identity security
Extending Timeline Downloader: Identity Forensics and the 9000-Event Limit
An update to the Defender Timeline Downloader tool, adding support for Identity (MDI) timelines. This post details the "Skip 9000" pagination algorithm, GZIP compression support, and UI improvements for error handling.
- cloud forensics tooling
Defender Timeline Downloader: Extending Data Retention for Incident Response
A technical deep dive into overcoming Microsoft Defender for Endpoint's 30-day API retention limit. This post details the architecture and authentication mechanisms of a new Go-based tool that automates the extraction of the full six-month timeline data.
- malware analysis tooling
From Analysis to Tooling: Automating Amatera C2 Extraction
A technical update on Acreed analysis, detailing CAPE Sandbox contributions and a new unified static-dynamic extractor for Amatera.
- general
Welcome to My Blog
Introduction to this technical blog covering malware analysis and incident response.
- malware analysis research deep dive
Unmasking Amadey 5
Deep dive into the Amadey 5 botnet client and its role in a sophisticated cross-platform malware campaign.