Threat intelligence & response · Archive

Threat intelligence & response

Dates are publishers’ publication dates, source update dates, or CISA catalog-added dates. First collected records when SecSIG first saw the entry.

• InfoSec News Nuggets – 10/21/2026 ↗ (opens in a new tab)

  AboutDFIR – The Definitive Compendium Project · Published 2026-10-21 · First collected 2026-10-24

• Reversing Engineering a Captive Portal ↗ (opens in a new tab)

  Binary Ninja · Published 2026-10-06 · First collected 2026-10-24

• Field Notes: Reconstructing the Attacker's LSASS Dump ↗ (opens in a new tab)

  dfir.ch · Published 2026-09-30 · First collected 2026-10-24

• The USB Camera That Freezes Windows: A usbvideo.sys Descriptor Parser DoS Microsoft Won't Fix ↗ (opens in a new tab)

  Delphos Labs · Published 2026-09-04 · First collected 2026-10-24

• Overview of Content Published in August ↗ (opens in a new tab)

  Didier Stevens · Published 2026-09-01 · First collected 2026-10-24

• Redis 8.6: Remote Code Execution via Stream PEL Use After Free ↗ (opens in a new tab)

  zerotistic · Published 2026-07-08 · First collected 2026-10-24

• Clonegroups ↗ (opens in a new tab)

  Joe T. Sylve, Ph.D. · Published 2026-06-09 · First collected 2026-10-24

• Apache ActiveMQ Exploit Leads to LockBit Ransomware ↗ (opens in a new tab)

  The DFIR Report · Published 2026-02-23 · First collected 2026-10-24

• Exploiting MediaTek's Download Agent ↗ (opens in a new tab)

  R0rt1z2 · Published 2026-01-30 · First collected 2026-10-24

• 0.9.12 is out: Python 3.14, PYC and .NET stack analysis ↗ (opens in a new tab)

  MALCAT · Published 2026-01-14 · First collected 2026-10-24

• Flare-On 12 Write-Ups ↗ (opens in a new tab)

  Washi · Published 2025-12-23 · First collected 2026-10-24

• Yet Another DCOM Object for Command Execution Part 2 ↗ (opens in a new tab)

  Sud0Ru · Published 2025-12-19 · First collected 2026-10-24

• Don't judge an audiobook by its cover: taking over your Amazon account with a Kindle ↗ (opens in a new tab)

  THALIUM · Published 2025-12-16 · First collected 2026-10-24

• Passware Kit 2026 v4 Simplifies BitLocker Decryption And Adds E01 Export ↗ (opens in a new tab)

  Forensic Focus · Published 2026-10-21 · First collected 2026-10-24

• InfoSec News Nuggets – 10/20/2026 ↗ (opens in a new tab)

  AboutDFIR – The Definitive Compendium Project · Published 2026-10-20 · First collected 2026-10-24

• Debugger Conditional Breakpoints and the Expression Parser That Backs Them ↗ (opens in a new tab)

  Binary Ninja · Published 2026-09-29 · First collected 2026-10-24

• BSides Tallinn: Deconstructing Modern macOS Initial Access Vectors ↗ (opens in a new tab)

  dfir.ch · Published 2026-09-25 · First collected 2026-10-24

• CVE-2026-50321. How A Normal WinUSB Feature Exposed A Pipe-Lifetime Race ↗ (opens in a new tab)

  Delphos Labs · Published 2026-08-25 · First collected 2026-10-24

• Update: base64dump.py Version 0.0.31 ↗ (opens in a new tab)

  Didier Stevens · Published 2026-08-23 · First collected 2026-10-24

• Transparent Compression (DECMPFS) ↗ (opens in a new tab)

  Joe T. Sylve, Ph.D. · Published 2026-06-08 · First collected 2026-10-24

• Cat’s Got Your Files: Lynx Ransomware ↗ (opens in a new tab)

  The DFIR Report · Published 2025-12-17 · First collected 2026-10-24

• Windows Inter Process Communication A Deep Dive Beyond the Surface - Part 9 ↗ (opens in a new tab)

  Sud0Ru · Published 2025-11-30 · First collected 2026-10-24

• Life Updates and Other Ramblings ↗ (opens in a new tab)

  Washi · Published 2025-11-07 · First collected 2026-10-24

• Investigating WMI Permanent Event Subscription Persistence ↗ (opens in a new tab)

  Forensic Focus · Published 2026-10-19 · First collected 2026-10-24

• InfoSec News Nuggets – 10/19/2026 ↗ (opens in a new tab)

  AboutDFIR – The Definitive Compendium Project · Published 2026-10-19 · First collected 2026-10-24

• The .zshrc.zwc You Forgot to Check ↗ (opens in a new tab)

  dfir.ch · Published 2026-09-21 · First collected 2026-10-24

• Binary Ninja 6.0 (Krypton) ↗ (opens in a new tab)

  Binary Ninja · Published 2026-09-03 · First collected 2026-10-24

• Overview of Content Published in July ↗ (opens in a new tab)

  Didier Stevens · Published 2026-08-01 · First collected 2026-10-24

• Threat Intel: ValleyRAT. A Zero-Detection Stager Classified 24 Hours Before Its First Signature ↗ (opens in a new tab)

  Delphos Labs · Published 2026-07-14 · First collected 2026-10-24

• Hard Links and Siblings ↗ (opens in a new tab)

  Joe T. Sylve, Ph.D. · Published 2026-06-05 · First collected 2026-10-24