Andrew Rathbun retweeted
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
Andrew Rathbun retweeted
1/ EZ Tools 2026.10 is out, all on .NET 10 (LTS)
✅ More accurate: 331K more event log records, hive logs replayed as Windows does, every test hive loads
⚡ Faster: up to 9x; EvtxECmd and Registry 2x
📉 Less memory: up to 82% less
Update with Get-ZimmermanTools 🧵 #DFIR
Andrew Rathbun retweeted
HUGE news about the October release of EZTools is coming soon! You wont believe your eyes! #DFIR
Andrew Rathbun retweeted
Paid opportunities for cybersecurity professionals of all specialties and experience levels, we have two great opportunities to introduce you to CyberStudio by SANS, a new training platform now in development. (Yes, I am writing a course for this!)
Beta testing: For professionals based anywhere in the United States, we invite you to test drive CyberStudio and participate in a follow-up interview (online) to share your thoughts.
When: 9/21 through 10/26
Register to be a beta tester at survey.sans.org/jfe/form/SV_…
Focus group: For professionals in the Las Vegas area, we’d love for you to join us in-person at Caesars Palace to get an introduction to CyberStudio and share your thoughts.
When: Thursday, 9/24, evening (1–2 hours)
Where: Caesars Palace, Las Vegas
Register for the focus group at app.smartsheet.com/b/form/01…
Focus group attendees and beta testers will be compensated! Thanks in advance.
Andrew Rathbun retweeted
🧟 Abeebus is back from the dead. v2.1 is out.
It pulls IPv4 addresses out of any file and gets GeoIP data for each one from ipinfo.io.
🔧 The big fix: it used to read the entire file into memory. Fine for email headers, not so great for a memory image. It streams now.
Also keeps your results if you hit the ipinfo.io rate limit.
If you prefer a native Windows binary, try SharpAbeebus.
github.com/13Cubed/Abeebus
github.com/13Cubed/SharpAbee…
Andrew Rathbun retweeted
The first 13Cubed mini course, Architecting the Hunt, is now available! 🎉
An entry-level, hands-on introduction to threat hunting, learn a repeatable framework, then put it to work in a self-contained lab. No prior experience needed.
Watch the launch video 👉 youtube.com/watch?v=cFxwYz5T…
Enroll 👉 training.13cubed.com/archite…
#ThreatHunting #DFIR #BlueTeam
Andrew Rathbun retweeted
The very first 13Cubed mini course is coming, and we couldn't be more excited! 🔥
🎯 Architecting the Hunt takes you from zero to confident threat hunter with a repeatable framework, then drops you into a hands-on lab with 100 hosts and 9M+ events to hunt through. 🕵️
✅ Entry-level
✅ Hands-on lab (yours to keep!)
✅ No experience needed
The waitlist is OPEN 👇
training.13cubed.com/archite…
Andrew Rathbun retweeted
The Weather Channel has started letting you opt into a retro version of the forecast, and it's delightful. Includes the music and everything.
weather.com/retro/
Andrew Rathbun retweeted
The Evidence Locker has been updated!
- 6 challenges from @RedHatPentester (Vehicle triages, network captures, Windows and more)
- Jimmy Wilson test image
theevidencelocker.github.io/
Do you have more that you want included? Check out the "New Submission" button on the page or send me a DM. #DFIR #MobileForensics
Andrew Rathbun retweeted
🎉 A new 13Cubed episode is up!
This time we're exploring the USN Journal on a live system. How can we view it while Windows is actively running, and does the reality match the common explanations? Let's find out!
youtube.com/watch?v=eSLHyqZl…
#DFIR #DigitalForensics
Andrew Rathbun retweeted
Really enjoyed this interview by @elijahwoodward9 with @bunsofwrath12 on Team Cymru’s “Future of Threat Intelligence”
A lot of good DFIR points in there that often get ignored in enterprise envs:
- why default Win event log sizes are a forensic disaster
- why Sysmon deployments are often stale or incomplete
- the forensic value of Volume Shadow Copies and the $J USN Journal
- why EDR alone is not enough
- how true positives get buried in alert fatigue
- using AI as a force multiplier for parsing logs and writing one-off tooling, while still not treating it as forensic ground truth
Also liked the practical angle throughout the whole discussion. Felt very experience-driven, not theoretical.
Worth watching
youtu.be/4KF9jkoM0V4?is=8SMf…
Andrew Rathbun retweeted
All EZ Tools have been updated! New version is 2026.5.0 across the board.
Nuget updates, control updates, bug fixes and general refreshing of everything.
Enjoy!!
#dfir
Andrew Rathbun retweeted
We are pleased to announce the release of macos-collector v1.6.0! 🚀
Notification Center Database File Collection, Paste Protection, and XProtect Version Check added. Happy macOS Threat Hunting!
github.com/LETHAL-FORENSICS/…
Andrew Rathbun retweeted
New t-shirt designs are now in stock at shop.13cubed.com. This one is our favorite! 😍
Andrew Rathbun retweeted
A New #DFIR Peer-reviewed article has been published on @DFIRReview by "Is that Windows Notepad window really empty?" by Christopher Eng.
#WindowsForensics #DigitalForensics
dfir.pubpub.org/pub/wmhy8t6v…
Andrew Rathbun retweeted
🚨OPEN NOW! The @EricRZimmerman #EZToolChallenge at #DFIRCON is accepting submissions! Got a #DFIR tool idea? 🛠️ Submit it by 8/29. Eric will unveil the winner during his keynote!
👉 Submit: sans.org/u/1CrZ
🔎 DFIRCON: sans.org/u/1Cs4
Andrew Rathbun retweeted
We just issued our 500th 13Cubed certification! 🎉 Learn more at 13cubed.com/certs. All Windows, Linux, and macOS courses include certification attempts at no extra cost, allowing you to demonstrate real-world practical application of forensic investigative techniques. 🏅
Andrew Rathbun retweeted
Windows forensics is essential—but don’t overlook Linux or macOS. These platforms are steadily gaining ground in enterprise environments. Make sure you have the skills you need to investigate them too!
youtube.com/watch?v=_D6oHm-3…
Andrew Rathbun retweeted
We analyzed the top 500 most successful THOR rules – “successful” meaning: they detected samples that were either ignored or missed by nearly all AV engines on VirusTotal.
Some rules detect clear malware. Others reveal dual-use tools, renamed hacktools, misused admin binaries, or forensic leftovers.
Most of these samples showed 0 AV detections, the rest only minimal hits.
Not all threats are payloads. Not all detections are flashy.
But these rules consistently light up the blind spots in AV and EDR coverage – where attackers hide comfortably.
THOR doesn’t replace existing tools. It shows you what they forgot to tell you.
nextron-systems.com/2025/06/…
