Posts Tagged ‘Digital Forensics’

Encryption was originally used only for the transfer of confidential information. However, subsequently the information was encrypted for the purpose of storing it in unreliable sources.

Karim El-Faramawi described in detail the dissecting obfuscator LLVM in his blog, as well as any possible shortcomings in the implementation of obfuscative passages.

Sysmon is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. Sysmon does not provide analysis of the events it generates, nor does it attempt to protect or hide itself from attackers. It runs in the background all the time and writes events to the event log.

There are several blogs on the Internet that tell you about a suitable method for monitoring Windows event log entries through Elasticsearch. It explains how to perform this process, including some documents from the Elastic team. This process requires a lot of effort to do it right.