We're all petrified about missing a critical event or misclassifying an alert, but when we're talking about incident response (IR), there are often hundreds if not thousands of alerts to parse through. It's easy to get caught up with one alert because it feels "too hot" or maybe not spend enough time looking into something that initially seems "too cold."

The post Finding the “Goldilocks” Zone: A Practical Approach to Alert Triage appeared first on Black Hills Information Security, Inc..

By Troy Wojewoda During a recent Breach Assessment engagement, BHIS discovered a highly stealthy and persistent intrusion technique utilized by a threat actor to maintain Command-and-Control (C2) within the client’s […]

The post The Curious Case of the Comburglar appeared first on Black Hills Information Security, Inc..

Troy Wojewoda // In honor of Shark Week1, I decided to write this blog to demonstrate various techniques I’ve found useful when analyzing network traffic with Wireshark, as well as […]

The post Welcome to Shark Week: A Guide for Getting Started with Wireshark and TShark appeared first on Black Hills Information Security, Inc..

Hal Denton // Have you ever been given an encrypted hard drive to perform forensic analysis on? What could go wrong? Probably the first thought rolling through your mind is […]

The post Who’s Bootin’? Dissecting the Master Boot Record appeared first on Black Hills Information Security, Inc..

Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_AttackTactics7LogsYouAreLookingFor.pdf So we went through an attack in the BHIS Webcast, “Attack Tactics 5! Zero to Hero Attack.” Then we went through […]

The post Webcast: Attack Tactics 7 – The Logs You Are Looking For appeared first on Black Hills Information Security, Inc..

Kent Ickler // TL;DR: This post describes the process of building an active system to automatically recon SPF violations. Disclaimer: There are parts of this build that might not be legal […]

The post Offensive SPF: How to Automate Anti-Phishing Reconnaissance Using Sender Policy Framework appeared first on Black Hills Information Security, Inc..

John Strand// Here’s a live demo of John’s recent blog post that talked about gamifying your table top Dungeon and Dragons style. Join John, Kent, Jordan and Sierra as they […]

The post WEBCAST: Cubicles and Compromises appeared first on Black Hills Information Security, Inc..

John Strand// Thanks for joining us for our Cubicles and Compromises webcast! We also have a recording available soon! In the meantime, here’s a blog post explanation: And, here you’ll […]

The post Cubicles and Compromises Printable appeared first on Black Hills Information Security, Inc..

Melisa Wachs // Hello IT professional.  If you haven’t heard it lately, I hope you know that you’re really amazing. You’re probably helping “laymen” like me all day long. Maybe […]

The post The Rejected Box – An Ode to IT Professionals appeared first on Black Hills Information Security, Inc..