Digital Forensics Applied to Kubernetes - Enhancing Intruder Dilemma Part III

  Read Time: 5 Minutes

Continuing sharing my research that started last year I am releasing my slide deck for "Digital Forensics Applied to K8S" and the presentations of this can be found here. I plan to continue to release content that addresses forensic analysis of containerization related technology and eventually relating that back to full CI/CD forensic analysis.  The release list as of now looks like this:

  • Docker Forensics*
  • Malicious Container Analysis*
  • K8S Forensics*
  • SAAS Containerization Forensics
  • CI/CD Forensics




Stay tuned for more content and leave your suggestions below!

Comments

Post a Comment

Popular posts from this blog

Digital Forensics Applied to Containers - Enhancing Intruder Dilemma Part 1

Image
  Read Time: 5 Minutes In 2020, I worked on several efforts that ranged from Malware targeting Mac OS X to Cloud Forensics.  For the remainder of 2021 I will be releasing the results of my research and I am leading with the release of my efforts on containerization forensics which is imbodied in my talk "Digital Forensics Applied to Containers: Enhancing Intruder Dilemma".  See a video of the original presentation at dc706 , most recent presentation at issacolga , the latest presentation slides , and a docker forensic cheatsheet .   Stay tuned for more content and leave your suggestions below!
Read more

Doppelgänging and Digital Forensic Analysis - Part Deux

Image
Read Time: 15 Minutes On 17th of December 2017, I wrote a blog post reacting to Blackhat 2017 EU presentation on a new Process Hollowing Technique named  Doppelgänging .   The original presentation from Blackhat (BH) EU 2017 can now be found on youtube to be seen it's full glory.  At the time I did not have proof of concept (POC) code and just a day later Hasherzade wrote some POC  code / blogged about it. Figure 1:  Doppelgänging  Conceptual Model Leveraging his code I took a stab to see what I could find based on the observations I made in my blog post and leveraging current memory analysis techniques to see what other indicators I could spot.  From my blog post I cited references from the original presentation, at BH EU 2017, that included looking at the windows executive object "FILE_OBJECT" and the attribute "ImageFilePointer".  Also, I remarked that the NTFS $LogFile would give some valuable clues. Looking at the "FILE_OBJECT" for t
Read more