High Stakes in Incident Response (Full Version)

Hey everybody, what's up? Welcome to Simply Cyber Firesides. I'm your host, Dr. Gerald Dozier, and today we have a wicked exciting episode lined up for you. We're going to be diving into the fascinating world of digital forensics, a crucial field if you didn't know, in today's cybersecurity landscape. You know, every time there's a ransomware incident, Digital forensics people deploy down. It's awesome. Digital forensics, it plays a vital role in uncovering the intricacies of cyber incidents. What happened? Helping understand, mitigate, who knows, maybe do lessons learned and prevent it from happening in the future if done correctly. Not all programs do it that way, but they do, they do try to understand. And in an era where cyber threats and threat actors are getting more and more sophisticated, the expertise in digital forensics is incredibly indispensable and super valuable. Today, I am wicked thrilled to introduce a very special guest to the Simply Cyber community, Jibran Ilyas. Jibran is the managing director at Google Cloud, a.k.a. Mandiant, and was honored as one of Crain's 40 Under 40 for his significant contributions to our field of cybersecurity. With over 15 years of experience in information security, Jibran specializes in incident response, digital forensics, and threat intelligence. He's investigated some of the world's largest breaches in the financial, technology, and defense sectors, working closely with law enforcement agencies to bring major threat actors to justice. Yes.

Regulators!

I love it, right? Getting the regulators mounting up in here. Jibran's work is renowned in the cybersecurity community. In 2008, he was the first to publish a white paper on memory dumping malware. Leading to significant advancements in understanding large-scale breaches in the retail industry. His findings were even featured in Visa's Data Security Alert. And now, beyond his professional achievements, as if he wasn't already crushing it, Jibran's an adjunct professor at Northwestern University. Now, I'm an adjunct professor at Citadel Military College, and that's— we're definitely not the same thing because I just teach a curriculum that's already there. Jibran developed and teaches a full curriculum on digital forensics and incident response at Northwestern, which I might add is a wicked prestigious school. He's presented at numerous global security conferences. If you go to his profile, you'll see he's got the header image on his LinkedIn of the really cool one where it's like zoomed down. There's like 4,000 people in the audience and he's just like owning the stage. That's the guy we're about to talk to. He loves sharing his knowledge, sharing his insights with the broader cybersecurity community. He definitely represents all the things that the Simply Cyber community is all about: support, inclusion, knowledge share, you know, fighting the good fight. We're really, really incredibly fortunate to have Jibran with us today. I'm super excited. So please make sure to engage in chat. Simply Cyber community members, you know what the deal is. Ask your questions. I'll get that. I'll get out of the way and Jibran will answer them. I'm here to facilitate. Let's make the most of this opportunity. We only have an hour with Jibran and the man's got more than an hour worth of knowledge to share. Believe that. So do me a favor, grab your Oprah emotes, my squad member friends, and we can welcome in my friend Jibran Ilyas to Simply Cyber Live. Let's go get him. Jibran, what's going on, man?

Hey, Jerry, thanks for such a kind intro. Appreciate it.

Oh yeah, I mean, it's easy when your resume reads like, like, you know, just a fan, like a unicorn resume kind of thing. But Not, not to make you blush or anything, but, uh, yeah. So Jibran, like, you know, how are you and how have things been?

You know, it's been a great year. Uh, we've had, um, you know, huge, um, healthcare, um, data breaches, um, actually for the last 14, 15 months. And, uh, we've had good fortune to, um, to serve as a responder. And, um, you know, My mom, when I was growing up, she always wanted me to be a doctor. My son's gonna be this noble guy who's gonna save lives. And I couldn't, you know, I didn't get into that field, you know, I wasn't into it. And I always regretted it. I was like, you know what, it would have been noble to save lives. So finally, like in the last 15, 16 months, as we're responding to healthcare data breaches, It feels like, uh, well, actually, people tell us that we have saved lives through our quick response and recovery efforts. So yeah, things have been great because we feel like we have a purpose in life now, and that's a very noble purpose of saving lives and curing people, uh, through, uh, you know, what we do.

Absolutely. Get Mama Ilyas on the phone and let her know, you know, you're doing it, you're doing it your own way. Well, so then let's, let's take it back to yesteryear, Jibran. So, you know, you said you, you know, the family was pushing you to get into medical. You weren't feeling it. Obviously you got into cyber and digital forensics. Like, what did that look like? Did you, did you like just rip apart your Atari and you're like, all right, I got to get into the cyber stuff?

Yeah, uh, I was, I was actually a CS student, so I was like learning Java, C++. So that's what I was doing. And then, uh, you know, this is— and I'm probably gonna give away my age now— this is right around the time of Napster. Um, so, uh, my dad, he's like a big, you know, Bollywood fan, or like he listens to music from like all, you know, South Asian countries, right?

Mm-hmm.

He had a lot of like cassettes, like videotapes, and like, you know, those audio cassettes. Um, and I, you know, Basically, I wanted to show off, and I said, hey, what if I digitize all your music and it's just going to be like on a computer? He said, it's a good idea, but I'm still not throwing these things away.

Mm-hmm.

So I was like, okay, I'll give it a go. And then, you know, I trained him on the computer and he started liking it. And he said, you know what, all of this room, all of my closets are full of these cassettes and, you know, videotapes. Now that things are working, I'm actually just gonna throw it. So he did. And then I'm sitting in a dorm room, um, at Nepal— that's where I went for undergrad— and because hacking was really new at that time, you know, all that music, uh, that I put, uh, on Napster and, you know, uh, on a LAN, that just went away one day. I was like, oh crap, I just got hacked. And, uh, you know, so I had to basically train myself to do Uh, not just forensics, but, uh, digital data recovery. So because I was like, if I tell my dad that, hey, you've thrown away all your cassettes and videotapes from like 1950s, uh, he's not gonna like it and he's gonna be like, yeah, you stupid thing, right?

You ruined me, you've ruined me, Jibran.

Yeah, so the stakes were very high. Um, so that, that was my first, um, insight into like this forensics, digital forensics, and kind of like tracking who did what. And then I was an ardent like hacking fan, so I would go in on these forums and I would be like, hey, somebody teach me. So a lot of people took advantage of me and they, they said they would teach me, but they were using my system for like lots of bad things. And, uh, so I quickly learned, uh, how to counter that through like, you know, I would just pull up all the connections like, okay, this guy is connecting and there's this many bytes going out of my computer. What the heck's going on? Basically, and then I had one job to remove spyware. This is right around the time when there was Sasser worm, Blaster worm, when people's Windows computers were given like 30-second countdown. This is right around the era of pop-up windows, computers getting slow. So when I got the training at this firm, they were using tools like Spybot, HijackThis. So I would always read the logs of like, hey, how is it removing, uh, the spyware, or how is it removing, uh, these potentially unwanted software? So I learned the Windows registry, and I fell in love with it. It's like, oh, I could do this manually. I don't need to be relying on this one tool because the tools have definitions.

Right.

Right? And I was like, I want to do one better than this tool. So I kind of just ripped apart the Windows registry, and that skill is still paying off in the digital forensics incident response work that we do, just figuring out, like, how applications persist, how malware works. So all of those 3 things, you know, that kind of shaped my career, and I've been in love with this career ever since.

Yeah, I love cybersecurity personally. Like, I just can't get enough of it. Like, You know what, what, you know, especially digital forensics. I don't do it professionally, but it's, it's like solving a puzzle or like doing the Wordle or, you know, whatever. Uh, it's awesome. But so I do appreciate that 2 things that you said there. One is when you were coming up, I will say that like Napster was big in college when I was in college. So, you know, I have the gray, you know, so I'm right there with you, Jibran. But, um, but, but, um, but there wasn't really great cybersecurity knowledge out there or learning opportunities. There certainly wasn't nearly the resources we have today. So, you know, a lot of people find their why when they experience being victimized in some capacity. And it sounds like not you— you were victimized, but that wasn't really the driver. It was not having to explain to your father. Like, basically, you had to, like, figure it out or not go home. Absolutely.

Yeah, yeah, it, it was bad. And you know, you mentioned, uh, one really interesting thing, right? Like, at that time, I think there was a movie that— there was a series called National Treasure. I don't know if you know. Um, and it was about like building upon clues after clues, right? And then they would say, okay, you know what, get another clue. So, so forensics, like the puzzle thing that you just mentioned, it reminded me of that, that you're trying to solve a puzzle. Except you don't know what the end puzzle looks like. You know, you know something's bad, so you're still like at an advantage. But, uh, the puzzle thing, actually, that's a, that's a great analogy. Yeah, you're trying to solve that piece by piece, and you have to be so patient. You know, one thing that I realized in this career, yes, there's tech, right? There's— you need to be, you need to be a fast learner. You need to learn a lot of technologies.

Mm-hmm.

But there's so much about— so much to be said about perseverance, your stamina, your character, your personality, right? Like around, like, hey, if you're gonna do something, like, hey, even if it takes all-nighters, you just gotta do it. And when the stakes are high, when the mission is in front of you, like especially like, um, you know, saving lives, um, and saving, you know, sensitive data from our corporate environments, It just makes you want to go so hard to protect the data.

Yeah, no, dude, 100%. And, you know, I'd love your thoughts on this because when you do a Wordle or crossword puzzle, there's a known solution. Like, it's known you're going to get to it. You can even, like, look it up tomorrow and get the full solution or whatever. With digital forensics, sometimes you can't get the whole picture. Sometimes you can only make assumptions, right? Sometimes, you know, you can't disprove a negative. So maybe you don't know if you fully eradicated them out of the environment. How do you— like, I don't know if you have a structured approach to dealing with that particular challenge or if there's a framework or something or how you reconcile with that.

Right. Great question. I think proving a negative part, that's the hardest thing in incident response and security operation centers. Known as SOC. I think what is important is to know the operating systems so well, is to understand, you know, the layer 3 really well, is to basically understand the fundamentals really well. 'Cause once you know that, once you're confident in how your device or your appliance or computer system is supposed to work, and then there is an anomaly, then you know, like, how to spot that.

Mm-hmm.

When I teach at Northwestern, I say, hey, I'm probably going to teach you 50, 60 artifacts between Linux, Mac, and Windows operating systems. Your success at the end of the quarter, if you want to evaluate it, you should know if I'm asking this question, how many artifacts that you want to look at and which artifacts out of those 60? Because you can't have that approach that for every question you go across all 60, 70 artifacts. So if you know, like, hey, how operating systems work, and there's a question, and then you know which artifacts to parse, how to create that central timeline of events, and then you're looking at the facts, your confidence level keeps rising. There's nothing that you could say like, hey, 100%, right? But we use language like low, medium, high confidence.

Yep.

And high confidence is where you want to be. And, you know, in incident response and just cyber defense in general, if you think about it, nobody can guarantee, like, 100% security, right? I think the name of the game is, like, how do you make your approach defensible? Because all of these cases, they end up in court. There's, like, regulators talking about it, as you might have read in the news. So what do you do that makes you look defensible because, you know, you've done the max that you could with the resources that you had at any given point in time. So, you know, the approach really, to answer your question in short, is that you learn the operating system so deeply and so well that, you know, when there is a question about normal versus abnormal, you know that. You've learned the artifacts of operating systems so well, even better than like the operating system maker, like— Sometimes in digital forensics, like, uh, you ask Microsoft, sometimes it's like, we didn't create this artifact for forensics, we created this artifact for speed. You're using it for forensics, which is great. So it's, it's, it's the innovation, um, that, uh, you get when you go so deep, is you, you know, you just figure out things that, uh, aren't meant to be. And you go, um, you find, um, you know, the attackers, right? There's this low-carbs exchange principle Not sure if you've heard of that.

Can you repeat that?

Yeah, the Locard's exchange principle.

Okay.

So this is kind of like the fundamentals of forensics, right? If I am here and I touch the screen, right? If I am walking and my shoes are touching the carpet, it's the exchange principle basically says that, you know, when you make an impact, you're leaving traces. So the hackers, they're really at offensive security, but they don't know how many tracks they're leaving behind. And that is a job of a good forensicator or a good digital forensics incident response folks to understand, like, what artifacts are possible and then basically track those. So, you know, sometimes attackers delete stuff, but, you know, in digital forensics, we can recover a lot of that, right?

Right.

So again, just knowing, the possibilities, knowing the operating system, knowing the tools so deep that you gain a certain number of confidence that makes you give those statements to the clients. Because one of the first questions that, you know, anybody would ask, like, let's say, you know, you had a big organization, the minute you get hacked, you know what's going to happen? Your partners are going to disconnect from you. And do you blame them? Not really, right? Because you're going to They're saying, well, you're hacked, why would we still stay connected to you? Because through you, uh, I can get hacked. So, you know, when we do this work, one thing that people want from us is, uh, what they call, um, letters of attestation.

Mm-hmm.

That, hey, we looked at this, this, and this, and now we want like your stamp on it that you've looked. So that comes when you know, uh, the subject with the operating systems deep enough, when you know the tools deep enough, and when you know the artifacts deep enough. So with those 3 things, we're able to deliver. And that goes for probably all companies, all forensic investigators out there. That's the confidence levels matter in this work.

We're talking with Jibran Ilyas. He's a digital forensics expert with tons and tons of real-life practical experience. He's lived in the trenches. He's wearing a suit jacket right now, but the man's got scars all over, okay? I do see the questions coming in from chat. Chris Whitlock, James McQuiggan, folks over on LinkedIn. I'll selfishly ask one more question of Jibran, and then I'll release the hounds, as it were, and let Jibran get after it. So, Jibran, you know, these 60 artifacts that you want these students to learn and all the incidents you've been basically dropped into, is it common to have, like, say, like these You know, I know there's tons of different threat actors and there's probably an 80/20 rule here, but is there like 5 artifacts that are like, oh my God, like no matter what, we do those and most of the time that's enough and we're good to go? Like, is there— because, you know, people getting into digital forensics, which is what these questions are about to be about, it seems overwhelming with all the artifacts and all the, you know, Linux and Windows and all this. Like, is there a kind of a sweet pile of artifacts that you'd want to kind of look at first?

Yeah, absolutely. One of the artifacts that I love is called MCache. Because a lot of times, I'll describe this artifact in a minute, but think about what questions the companies who are paying you $600 an hour, $800 an hour, what do they want to know? They want to know what ran on the computer, how did How did the attackers get in? What what was the damage? What data they took out? So one of the things that we have to answer is what programs ran on the system. So this artifact is is so good because it tells you like hey this ran at this time and it gives you the hash of the file as well because you could run your malware as svchost.exe and a lot of analysts will. to say, hey, okay, well, let's Google svchost.exe, and you put it on a search engine, Google, and it will tell you, yeah, it's a Windows binary. But when you have the hash, you can actually search that in VirusTotal, and it will tell you, oh, this is actually not the real svchost.exe, this is some keylogger, or this is some, you know, memory scraper, like, you know, or it's a Mimikatz to get credentials. So that's, that's an artifact that I like a lot because it breaks up a lot of data.

Can you repeat that? Is it MCache, like the letter M?

Yeah, A-M-C-A-C-H-E.

A-M, so Apple, Michael?

Yeah, MCache.

Okay. Oh, I've got it here. All right. Yeah, I'm gonna pull it up. I mean, that sounds like one that everybody should start with. That, that's like day one, welcome to digital forensics, get your chair, welcome to MCache.

Yep, yep, yep. So the other thing I would say is, um, you've got these Windows logs that are kind of like logs on steroids now because before it used to be just 3 logs: System, Security. And so now it's basically, you get PowerShell logs, you get remote desktop logs. So all of the things that are happening on your computer, there's a log for it. Because now, you know, before we used to have like 20-gig hard drives, 40-gig hard drives, so logging you know, it didn't justify that you would have just gigabytes of logs. Now, like, hard drives are like half a terabyte, a terabyte, right?

Yeah.

So there's a lot of room for logging. So look at the Windows logs. The other really, really good artifact— I'm going to go on Linux side for a minute, and then I'll come back to Windows. Like, if you're doing any Linux investigation, there's an artifact called Bash history. which is in your profile. So every command, like if an attacker compromises your Linux system, you can actually just go to your Bash history and see what commands they were typing in. 'Cause, you know, attackers, they use Windows, but when they are using Linux operating systems, then Bash history is a really, really good artifact 'cause it tells you like, More than the commands, it kind of lets you in on their cycling, right? Because you can see the progression. They're doing this command, this is reconnaissance, then they're doing this, they're now taking the credentials, then they're taking, um, the data, then they're trying to encrypt the system. So that's great. And then the equivalent of that on the Windows side, um, if you get a memory dump, there is A tool called Volatility. So I would highly encourage this tool called Volatility that you just download. And when you put— run that against a memory dump of a Windows computer, there are a few plugins. One is called Consoles, one is called Command Scan. And when you use that, everything that the attackers are typing in the DOS window to attack you, that gets logged. 'Cause, you know, attackers use command line a lot. Sometimes they use the Windows, but a lot of times they're using command line. So that's what you want. And then, you know, some of the other things that you want on a Windows computer, there's this thing called SRUM database, S-R-U-M. So imagine if, I tell you that, hey, if you're running a program, if attacker is running a program, there is this database that is tracking all the network traffic. Like for example, like if I install, say, AnyDesk on your system to remotely access your computer and for file transfer, SRAM database will actually monitor, will actually capture how much traffic went out from that program. Are you familiar with PowerShell? Jerry, so PowerShell, you know, back in the days we used to see a lot of malware. So now attackers are not using a lot of malware because, you know, some definitions will— may catch up, or, you know, some AI version of a tool may detect that it's malware. So attackers use built-in tools, and PowerShell is a very powerful tool. So attackers would use that to download things, to you know, upload things. So if you analyze the SRAM database, and there are tools out there that help you do that, you can actually see what, how much traffic went out from this PowerShell program, which is, which again breaks open the cases for us. So, so yeah, that's the, in short, there, there are so many other ones, but if you look at what— where the industry is going, there's a lot of good information in browser these days. So there is this tool called Hindsight. I highly recommend everybody to— like, if you use Chrome, just download Hindsight. There's a GUI version as well. And just play, play with that tool because it will tell you how many things your browser actually tracks. And it will just be a revelation. You'll be like, oh my God, this is— It's too intrusive. That's what you'll see. So yeah, and that's what attackers are doing these days, right? So have you heard of this concept of info stealers?

Yes, RedLine's a very popular one.

RedLine one. Okay, so you're in this world. Okay, so RedLine, I kid you not, sometimes, like, this is basically the start of an incident, like the RedLine on a system like somebody's home computer is running, it gets the password, and then with that password is also the URL. So the URL is, you know, probably for some remote access of the company. So if the attackers just have that, they can actually use that to gain entry into a network. And if they don't want to hack that network, they can actually sell that access for like $50,000, $25,000.

Wow.

So it's, it's pretty crazy how valued those things are. And sometimes, you know, what I— and I hope everybody is still with us— like, one of the most bizarre things that I've seen in the industry is how, like, antivirus software, they say, oh, this is low risk, this is medium risk, this is high risk, right? And I wonder, I still wonder, like, why would anybody create a low-risk malware? You know, if you want to create a malware, create a high risk, right? So it's categorized. The info stealers are categorized as low risk. But the impact is so huge, right? Because if you get a credential and there is single-factor authentication on a remote access portal, then you're into some network that could get you multimillion dollars in Bitcoins or Monero or whatever currency that you like to operate in.

Yeah.

It's getting so simple with these info stealers because they're the start of things. People don't consider that as that big of a threat, but But it is, 'cause now, you know, these things are being advertised in Telegram channels. Like, you go to a Telegram channel, it will say, okay, well, you've got these set of credentials, and they give you a sample too, so you can test and see how real that is, how much of my investment it's gonna be worth.

Yeah, first one's free, right? Yeah, I think Lapsus$, just to pull one that everybody's familiar with, I'm pretty sure Lapsus$, one of their initial, you know, entries as Redline Info Stealer to VPN that didn't have multi-factor authentication onto the network. And then, you know, from there, you know, PowerShell and such.

So yeah, but think about this. It doesn't even have to be a multi-factor versus single-factor thing. I don't know if you know, there was a vulnerability in Cisco ASA, which there was a bypass, right? So it's the— for all of single-factor authentication portals that ASA had, they were able to just get right in. So yes, credentials are important sometimes, but you've heard of like so many firewalls, right? Ivanti, Palo Alto, like all of these had like recent big CVEs. So what happens is that even if you don't wanna attack somebody right away, You just try that exploit and you get into so many networks and then you kind of decide, hey, do I want this one or do I wanna sell that access to somebody else? So I think people make a lot of money selling access too, 'cause if you can just say, hey, you know, like ransomware is one thing that you mentioned, right? So like a healthcare industry, transportation industry.

Yes.

Confidentiality and integrity is important, But what else is important? Availability.

Yeah. Oh yeah. Yeah.

So if your whole business depends on the availability and attackers take that away from you, then you're likely to pay that, you know, huge ransom amount. So that's what attackers are doing. You know, they're encrypting the networks and saying, okay, well, if you want the decryption key, you better pay us like $15 million in Bitcoin.

Yeah, it's nuts. And just so for those in chat, 2 things. Chat, if you can do the following, grab a link to this YouTube channel and post it to your social medias, because I don't think anyone expected Jibran to, to back up the value dump truck and just dump it on our head, right? He's like, oh, you know, Napster, my dad, I got into computer science, and then like, here's 50 tools that are going to absolutely revolutionize your capabilities as a digital forensics investigator. Like, Jibran, you just, you just like, there's people in chat who are just like, mind blown emoji. So—

I'll tell you this, speaking of tools, if you just run this tool called Kape, K-A-P-E, on your system, on your Windows computer, and then you look for like Eric Zimmerman tools to parse all that data that you collect through Kape, will get you real hands-on experience in this. And just take a memory dump of the system and use Volatility. What you will see is you don't need keyloggers, you don't need malware. Sometimes all the data that's in there, it's like gold mine. I actually did a talk at DEF CON SkyTalks. So, you know, there's this main DEF CON and then there's this SkyTalks, like you know, kind of like a B-side of DEF CON.

Yeah.

So the theme was that only the people close to you can hurt you. And what I did was I, I took a friend's memory dump, and what I was able to tell about him was, you know, it was very interesting. Let's just say that I knew because, you know, your memory tracks like where you go on your browser, right? So I kind of understood I just did a search on facebook.com, that was my grep on the memory dump strings, and I found out how many different profiles this person is stalking. Then just imagine, Jerry, if I get access to all the Google searches that you do, how much will I be able to tell about yourself?

Yeah.

There are these regex patterns that you can run on memory. Memory is two-way. Keylogger, if I'm typing something in, think about this. If there is a keylogger on it, attackers are only getting my side, whatever I'm typing. Memory, it's my side and it's the other side too. It's the whole conversation, whatever gets stuck in memory. It's that Hindsight tool for browser, Volatility for memory. I think when you run it, you're like, oh my God, this is really intrusive.

There's like—

Keyloggers made by nature.

Well, I mean, it makes me wonder, and I'm going to pull up these artifacts, uh, all these tools Jibran just mentioned on stream in a second just to kind of enumerate them. But it makes me wonder, again, I was going to get to, uh, chat's questions, but you've just taken me down this hole. What do you think about this Total Recall or whatever Microsoft's calling it? Microsoft Recall. I mean, were you in the digital forensics realm just like, oh my God, like Just, I'm gonna, I'm gonna go on to Costa Rica right now because my job just got so easy. I really don't need to be here anymore.

Yeah, I think, um, so I'll do a pass on this, but, but, you know, the, the thing that you have to know that if, if there is a tool, right, it's built for both purposes. I mean, it's, it's not— maybe it's some things are not intentional in a tool, Like I was saying about these artifacts, right? Like some of these artifacts, I don't think they're meant to be intrusive. Like, I'll give you an example, right? You know, are you from the Photoshop era?

Oh yeah, yeah, yeah. Or GIMP?

What happens when you open Photoshop for the first time? Because it's such a big program, it takes time, right? So there's an artifact in Windows, and you can actually, for the folks who are using Windows system, just go to Windows/Prefetch folder. and you will see like all the programs that you have run, uh, in the last few, uh, days. Um, so basically, like, the second time you run Photoshop, is it faster? The first time it— yeah, it is faster, right? So what's happening behind the scenes is it knows all the DLLs it needs to load, it knows, uh, the INI files and whatnot. So Windows prefetches. is basically an artifact that actually makes the software faster the second time. But we use it as a forensic artifact to prove whether or not a program ran on a computer or not. Because, you know, Jerry, you could have a file called evil.exe right on your desktop.

Mm-hmm.

But does that prove that that file actually ran? Not really. You need to prove to the court that, you know, if that goes that far, that, hey, this file actually ran on the system. And then you basically track it. So, you know, again, some of these tools, they're made for noble purposes to kind of make your operating system faster or your user experience faster. Like, I'll give you another example and another tool.

Sorry.

Yeah, here we go. So there's a tool, like, let's say attacker remote that stops into your computer, and then they're browsing different windows. Like, you know, they go to G drive, they go to the marketing share, and they go to like, uh, H drive, and then they go to the HR folders. So there, you know, when you open up a window, right, and you resize a window, like let's say you open up your downloads folder and you just resize it, the next time you open that folder, uh, guess what's gonna open? The resized.

Right, right. It knows your configuration.

Exactly. So it notes that. So again, Microsoft did that to make your operating system experience really good, right? So that next time you open the Downloads folder, it will open it in those exact dimensions. But guess how we use it for forensics? We love it because it— if something is tracking those window sizes, it's also tracking those windows' titles. So we, when somebody remote desktops in and when they're looking for data to be stolen from the network, we use the artifact. It's called Shellbags, just like it sounds. Shell, S-H-E-L-L, bags. So you basically parse that artifact, and it tells you which folders the attacker went to. Isn't that amazing? Because, you know, as I mentioned earlier, like, we get paid for, like, 3 things. One is, like, how did the attackers get in? 2, like what they ran, and 3, like what they took. So if you can answer or if you can give clues to the paying customer that, hey, which folders they were like targeting, which folders they were looking at, it's actually a great finding. So Shellbags, it's like a great artifact to track like which folders attackers were opening.

I love it. I love it. I love it. Okay. So before this stream ends, I'm just collecting tabs of tools now. We'll share them all. Let me get to questions because I love engaging the community. I selfishly have been hogging Jibran's attention here. We've got 23 minutes left and probably like 15 questions. So, you know, I'll let you manage the time accordingly. We'll go iteratively. Random anonymous on LinkedIn says, how do we get into digital forensics? Where do we start? What do you tell someone? I'm sure you get approached all the time.

Right.

I want to do what you do.

Yeah, yeah, great question. So I would say you, whatever operating systems that you're using, I would say learn all 3 really well. Actually, 2 more than the third one. Uh, Windows first and foremost, uh, Linux, and then the third— I, I used to say Mac, but then the third I would just say learn cloud. So the more fundamental knowledge that you have about you know, these platforms like Windows, Linux, and just cloud. And there are 3 clouds, so AWS, Azure, and GCP. There are more, but, you know, predominantly they're ruling right now. So if you know enough about how they work, you could do both things. You could go offensive technology like red team and pen test, and you could be a really good blue teamer, right? Because you would know what's normal versus abnormal. One of the things that I recommend is like, hey, you know, there are exploits out there with YouTube videos these days, right? So what you can do is just have a system, you know, all kinds of operating systems. So use one to attack, one as, you know, the victim system. So like, you know, you could have a Windows system as a victim and then just run Kali Linux as your attacker system, or you could have a Windows attacker system too, and then just attack. And because you would know what you did to the victim system, then challenge yourself to find your own activity with digital artifacts. So if you can do that, I think it's, it's, it's, it's a great win because you already would know like what you've done to that victim system. And until you solve for that, you keep trying.

Right.

And, you know, one thing that is really, really important in this career is your persistence. It's your perseverance, it's your stamina, it's your hunger, it's your passion. So once you actually do this exercise and you think you're having fun, come to me because then I want you in my team. So seriously, that's what we look for. If somebody like really enjoys this problem-solving and is resourceful and never gives up, uh, you know, those are like excellent candidates for us.

James McQuiggan wants to know, uh, he says the biggest, but I'll rephrase a little bit. What, what's like, what's one, you know, kind of valuable lesson that you've learned from doing digital forensics?

Yeah, uh, great question. I, I feel like when I got in this forensics, like when I was just, uh, learning all of this, I thought it was like a purely technical job, right? Because this is It sounds like that, right? It's kind of like the real forensics that you see in Law and Order and like these crime shows, like all that forensics without the blood, right? So I thought, okay, it's all about devices and it's all about like, um, you know, pulling artifacts. The biggest learning has been that, um, it's about people, uh, because when somebody's having a bad day, you come in as a hero to save their day. And I feel like, you know, when I walk in, I feel like, okay, I'm going to solve a tech problem. But I seriously, Jerry, I feel like I'm doing therapy. Like, seriously, I'm going in and I'm not just metaphorically holding hands. I'm like telling people like, hey, it's gonna be okay. It happens to the best of the companies.

Right? Right.

'Cause you can do all the tabletops in the world. You've heard of that, right? Like you do a tabletop for cyber, but you can't anticipate how people feel at the time that they're really upset, frustrated, depressed, right? 'Cause it's, they feel that they're gonna lose their jobs. Like they, some people that become CISOs and like cyber defense leads, They've actually put in 20, 30 years in their career, and they think that what a way to— what a way I will go out in my career as a failure. So you have to tell them like, look, this happens to the best of the best. We're going to be there to protect you, and, uh, you know, we're going to get you out of this. And that matters so much. And then they become our lifelong friends. We become their trusted advisors. We become their you know, go-to people on everything technology after that. So as much as I would like to say that I'm good, like one of the skills, the paramount skills is technical skill, it's about empathy. You have to feel for the cost, 'cause I'll tell you, like for one of our big data breaches, for 6 weeks we did not take a weekend off. For like 4 weeks we were working until like 8, 9 PM.

Yeah.

You can't do that if you don't care about the mission. You can't do that if you don't save— care about the world. You don't do that if you don't care about human lives. So yeah, it sounds very technical job, but really it's a people job. Like a lot of times you have to convince people to turn something off and whatnot. And like you basically walk in the first day, a lot of people doubt you. You know, they look— there's a lot of skepticism. So there is a skill that's not practiced, and I would love it if you can actually propagate this concept of cyber diplomacy. It's very, very important because you basically are trying to do something for them, and they're not convinced that you're giving the right advice. But you can't just say, hey, I'm Jibran Ilyas, I've done this for 20 years, so listen to me, right?

Mm-hmm.

You have to actually convince them Because if you can't convince them, you're, you're losing, you're on the losing end. Uh, so basically the thing is you take ownership of the mission at hand and then you basically transfer the ownership to everybody that's involved. And my belief in life is that when you give people ownership of things, magic happens.

Yes.

Because that is when they actually say, we're gonna give our absolute best because, you know, we're trained to work long hours, but not everybody is. You know, people get sick, people could have a lot of anxiety, right, because of this, because, you know, they're coming to the dance for the first time. We do this day in and day out. So we're, you know, actually one client told us, hey, yeah, I come to this Mandiant room for therapy because you guys are always cheerful and you guys are always positive, whereas other rooms, they're just panicked. So again, I think somebody mentioned layer 8. is the most important. I can't agree more. It's the people. Uh, so once you get through the people, tech is easy. Seriously, all these tools that I'm mentioning, I could teach you guys in a day and you know forensics. Like, this is one thing I say in my Northwestern class, is that if you know how to use Microsoft Word, you can use any forensic tool in the world because, uh, you know, they're either at that level or easier.

That's a good—

I'll tell you one thing, if a lot of people are still taking notes on, uh, tools, There is an artifact called NTUSER.DAT. You would find that in your profile. If you're using Windows, you'll see C:\Users folder and in there your profile folder. If you go there, there'll be a file called NTUSER.DAT. There's a tool by Harlan Harvey called RegRipper. You basically run that tool against NTUSER.DAT. You would be surprised how many things that are being tracked when you're in your profile. Like right now, if I run a command like CMD to bring up command prompt, that's tracked. If I open some program, that's tracked. If I type in a URL, that's tracked. So again, NTUser.dat is the artifact that is in every user profile of Windows. And then you can actually use RegRipper to parse out, and you would— it will blow your mind. You know, like if you open a .docx file, it will have a list of all the .docx files that you open. It'll have a list of all the PDF files that you open. So very— it will have even like the system registry. It will have like all the USB drives that you plugged in. So it's the forensics part. The technical part is really, really easy.

That's what it means.

Yeah.

So there, I mean, yet another like, uh, opportunity to make a video, a piece of content, a blog post, like teach yourself a skill. Again, like just Jibran, just, uh, delivering value. Like, like at some point, Jibran, people are like, you know, sitting, their belt is unbuttoned, their stomach is hanging over, and they're just like, no more, please don't feed me any more of these tools, man.

This is the one, right? Because you're You're like, I know the attackers did this. Now I just got to figure out how I'm going to prove it. Because we haven't touched a lot about threat intelligence, but to think about this, we have a huge component of this. Actually, not RegStripper, RegRipper. Close enough.

Well, you might pull down a different binary if you do that.

You would probably end up having Redline tool. If you actually search for Azure Threat Intelligence.

Yeah.

Yeah, those are the kind of searches. Yep, P.89, that's Harlan Carvey. Okay, so basically think about this. It's you with threat intel, you kind of get to learn like attackers' habits. Now, Jerry, if I ask you, you probably have habits that, you know, your significant other probably knows that you might not even realize. Same thing with attackers. They have certain habits. that they have. And once you know that, you know, you're able to track them well. Like, there are some threat actors, you know, if you put me on a chessboard, I can actually tell you like, hey, when I move my knight here, they're gonna move their rook here. So we do play this chess game with them, which is really, really interesting. So they're ahead of the game when we come in, but our goal is not just to break even. We wanna be 10 moves ahead.

Yes.

'Cause we wanna be able to read them and kick them out of the network. So, you know, there's this whole strategies piece in incident response 'cause, you know, if you just start blocking things, you remember playing this whack-a-mole game at Chuck E. Cheese?

Yeah.

That's what you end up playing, and it's really frustrating. So you wanna have a strategy to actually kick them out of the network. And for that, you have to play that chess game. You have to understand what your strengths are, and then, you know, kick them out one fine weekend and they go, oh crap, we can't get in. And that's when we say victory.

We've won.

We've won. Although that's just the start of things. After that, we do a lot of postmortem to find out.

Chris Whitlock wants to know, what tips and methods do you think are effective for effective communication and collaboration? You mentioned earlier communication is very important, but he's saying like, I think this is more of the tactical, like you're doing an incident response. What's an effective way to communicate to minimize confusion?

So 2 things I'll say. One, if I understand the question right, like, hey, maybe it's around like, do you communicate with the same client's email infrastructure? The answer is no. Until email is confirmed not affected, you want to be on an alternate path like Signal, Google Workspace, or like you know, other Microsoft tenant apart from your main communication lines so that— because I'll give you an example. One time, I had an attacker ask for $14 million, and I wondered, I'm like, well, not $10 million, not $15 million, not $20 million. Why $14 million? And basically, the attackers were reading email communications.

Oh my God.

They actually found out that the policy was $15 million, so they left $1 million for like forensics bill and legal counsel bill as well. So you wanna— you don't wanna have that sort of same communication channel. So if that was the question, but if this question was around, you know, how do you communicate as a whole in an incident? I'm a big fan of war rooms.

Yeah.

I like, you know, in COVID years we missed that because we weren't in person. But now we're bringing, as an industry, we're bringing that back because, um, you, if you're working in the same room and, uh, you're able to ask questions really quickly rather than saying, okay, well, it's 4:25, I'm gonna send an invite, uh, for 5 o'clock for, um, for a question to the client. That doesn't work. Incident response is really fast. The first 72 hours are critical. You know, you wanna, um, Get the attackers out of the network, and that's when it's really easy, right? You know, we don't have the luxury of that thing, right? That, hey, it's 5 o'clock, we're just gonna sign off and we're gonna come back tomorrow while the attacker is still attacking the network. So a war room, uh, what I say about communications is that you have to have like, um, one person at their end that is kind of like the command and control, and one person at like our end, like on the investigative end, that's command and control. And we basically, um, you know, track all items and we need to be empowered. The one thing that people miss, uh, the clients miss, they put a program manager that is not empowered. So when we say, oh yeah, we need to shut down this box, they go, well, you can't because we don't know what's, what's going to happen. As a matter of fact, like, you know, there, there was an investigation a hospital, and they had some routing issues, right? And they were about to shut down a system that would have affected, uh, maybe like a NICU area of a hospital. And, you know, one of my child is a NICU child, and I was like, oh my God, you know, if that goes down, a lot of children are going to be at risk. So we did some investigation to figure out like, hey, should it Actually, should they actually bring it down? Should they not? And we didn't, and thankfully it was the right call, and we saved downtime on a very critical network. So the people that are program, you know, PM, they need to be empowered, and they need to have access to the people who can get them answers really quick.

Yeah.

If we say that, hey, this is where Cobalt Strike is running, and you need to kill the egress, right, from that one server because, you know, attackers are communicating through Cobalt Strike beacon. And if somebody tells us, oh yeah, if we turn this off, we don't know what's going to happen, then, you know, we're stuck, right? But if somebody is empowered enough to actually call the business owner, like even if it's like some CMO, you know, or HR lead, and they get connected to the right person and they say, yeah, egress, there should be no reason why a domain controller should be talking to the internet, right? Like especially Especially outbound. So we need those kind of confirmations. So again, communications in a war room, that is really, really important. And for that, you need to be in one location. And when you are, you become one team rather than it's us versus them. So that is, you lunch together, you dinner together, you work late nights together. So the communications, again, there's such an important human element to it. You need to feel part of the same mission.

Got a quick one for you, just like a quick hit. Casually Joseph wants to know— by the way, Casually Joseph's loving this. He works in SecOps. What's your favorite flavor of forensics? Do you like memory, network? Is there another one that you prefer?

I love memory. So think about this, right? The disks, it's— You're getting terabytes of disk space these days. First you have to take the disk images, then you have to process them. That takes too long. Memory, these days you get 16 gigs, 32 gigs. Most you'll get is 64 or 128. You can analyze that very fast. It's so revealing. There's just so much in there. Like, if there's one other Google term that I'll give you, it's volatility cheat sheet. Just type that in, volatility cheat sheet, and you will get like all of these plugins. So you will just, even before you play with memory, you will understand like what kind of things you can hunt for in a memory. So think about this, Jerry, like you could have a malware, an obfuscated malware, and you just try to reverse engineer that, it won't— it might not work because it's obfuscated. But for a binary to actually work and, you know, use its full features, it's got to break open in the memory, right?

Mm-hmm.

So memory analysis arguably is better analysis than just file analysis because you see the true features of the malware or the binary that attackers are using, and that that is very revealing. And then, you know, these days EDR investigations are as good as, like, these, you know, on par, because with EDR investigations, you get, like, a central timeline, and you basically just investigate artifacts rather than, like, a full disk image. So that goes fast. But my bottom line is, like, whatever, like, incident response is not just on one system, right? Like, you do one system at a time, But you need a central timeline. So the biggest thing, like, if you're a business, you want to make sure that you have all the logging that is relevant, that's turned on, and it's going to the same console. Because you can't have, like, one Fortinet console where you're looking at firewall logs, and then one, like, your S1 console where you're looking at EDR, or, you know, and then another one where you're just taking look at Windows logs, you will be so confused. You'll be like, okay, well, how does it all connect? If everything is going in one window, like in one big console, that is what you want to do. But yeah, memory analysis, EDR analysis, they're so much fun. You learn so many things so quickly. One of my favorite things to do is if I grab memory, I look at it when I'm on my flight. And before I land, you know, sometimes, uh, the cases are solved and I go, oh my God, I just want to tell somebody really quick.

You just like turn to the, uh, to the, uh, like the single, you know, older traveler, older woman traveler next to you, like, I just cracked this case wide open. She's like, excuse me? That's so funny. Uh, really quick, uh, like I said casually, Joseph works in SecOps. He, uh, DM'd me while you're talking. He's like, I love memory, and I just wanted to share. This is like literally what he's— this is his inner monologue. My man, that's how he's feeling about you right now, Jibran.

That's awesome. Right, yeah, memory. And yeah, we should get in touch. I mean, it looks like you're that passionate about these things, so we should connect.

So what are the top 3 things that you would recommend an organization do if they think they're minutes from ransomware, right? Like, oh my God, I think this is happening. What do you recommend?

Great question. So I would say that if they could, they should just deny all egress traffic, because a lot of times the way that these things, the attackers are communicating with the environment is, you understand the concept of stateful firewalls. You know, you understand that if you don't have a NAT rule, like that's Allowing you to come in the network, you can't come in, right? Like on your system right now, like you probably have no incoming, right? But if something comes in your network through a spear phishing email or you downloaded something, what the attackers will take advantage of is piggybacking on the connection that gets invoked out. So Carbon Black— not Carbon Black, Cobalt Strike Beacon is one. One. Right? Tunnelers, you know, reverse tunnelers. So what attackers do is that they place something on the computer, they connect to your, the attacker infrastructure, and attackers basically piggyback in on that connection. So if you close the egress filtering, you are, you're doing really good, right? Because you've basically stopped, most likely, I mean, there could be other ways that they're coming in, It most likely stopped attackers' way of communicating with the network, right? The other thing is, um, most likely if you're like 3 minutes away from a ransomware attack, basically stopped— most likely. I mean, there could be other ways that—

All right, we're joined back here with Jibran Ilyas. This is the DR edition. He was bringing so much heat for digital forensics that we broke the internet. Jibran, thank you so very much. It's going to take a few minutes here for people to queue up, but if you recall what your final thoughts were on that last question, I think the overall question was, what are you doing with regards to you're going to have an impending ransomware attack? You had listed a couple of things, and you were giving your final thoughts.

Yeah, I think I'll recap that a little. So I think the first and foremost thing was you stop your egress traffic, especially from the servers. It's very challenging from the workstations. But so servers, you know, don't need— like, have you ever seen like somebody checking email on servers or like, you know, doing web searches? Like, servers are meant to be, you know, serve an application or purpose, right?

Right.

So a lot of people get nervous, but one of— if you're like minutes away, Then you want to take down attackers' communications. So if attackers are using Cobalt Strike or some other backdoor, you basically kill that there. And if you are minutes away from ransomware attack, then, you know, they probably have deep-rooted access, like domain admin access. So you want to rotate all the domain admin passwords. So 10, 20, you know, 50, like, you know, depending on how big the size of the network is. Yeah. So you take care of that. And the last thing is you want a lot of visibility. So like all the logs, like, you know, you can use Group Policy to turn on logging, especially like PowerShell logging, as I was mentioning, that attackers use tools like PowerShell because they're just built into Windows. They don't need to bring in malware. So the more visibility that you have, the better you're going to be able to kill the attack. So again, egress filtering, privileged access remediation, like domain admin accounts remediation, and increasing the visibility. Like, if you think that there is a part of your network that don't have EDR, that doesn't have logging, that's what you want to turn on, especially like on perimeter devices if it's like you suspect a zero-day exploit or something like that, because those, of course, appliances are notorious for not having the logs built in, right? Because there's always this confusion about who manages it. Does your firewall vendor manage it? Do you manage it? It doesn't matter who manages it. It's your risk. It's your reputation at play. You need the log. So yeah, those 3 things I would say: visibility, egress, and then credentials rotation.

The K Bandwidth wanted to know, were there any good sources that explain how to configure So he knows about the tool, but he says he gets lost configuring it.

So I think to create a memory dump, you don't need Volatility. You can do it from so many other tools like FTK Imager. There's MDD. So you could use a lot of different tools to grab a memory dump. Volatility, I think you just go, Like download Volatility, like especially like on Windows, you can just download the exe file and then you just run it like volatility.exe/ and then options. But in the cheat sheet, you will see all the configurations, like all of what you need to run. So first you have to figure out why Volatility, like what operating system that you're on. So I think the first— Yeah, this is actually great. This is the cheat sheet that I was referring to. Go to basic usage. Yeah, come. So if you do wall.py, like if you're using the Python version, but Windows is just wall.exe -f, and then you put the image path, like, you know, C, whatever, and then dash dash. There is this image scan is the name of the plugin that you use first. And once you have the image scan output, then you know which operating system that you need to type. So if you come down a little on this, so that --profile, yeah, image info, image identification. So there you go.

Yep.

And if that doesn't work, then do the kdbg scan, and one of these will get you the operating system. And then you go up. Yep, exactly. Go up a little, and then this profile thing that you see in basic usage. So you would just do wall.py -f and then image path, then --profile. And in the profile, you will put in like say Windows 2003 or Windows 2016, whatever memory image you have, and then the plugin. And then the plugin is like The basic thing is like history. If you go to the right side now to see all the plugins.

The right, let me see.

Yeah. You have all of these, like IE history if you want to know Internet Explorer history. If you keep coming down that connscan, you know what connscan is? It's like netstat. It will tell you what connections were open at that time. And keep coming down.

I do not know conscan. That's a new one for me.

Yeah, conscan is good. Consoles is my favorite one. And so go up a little, just up a little.

This one, connections and sockets?

No, conscan and sockscan. This is again netstat, kind of like netstat. But if you keep coming down, you'll see some of like the command line knowledge that you get. And it's just so revealing. It's, it's so it's not just the commands. But let's say you were actually running like pass the hash tool. It will actually have the output. Some of these tools will even have your output for those. You remember I was talking about registry?

Yeah.

You can actually dump registry. You'd think that it's memory, but it's so structured that it will dump memory. Then the timelines, if you look at these timeline plugins, Timeliner, Shellbags, MFT Parser.

There's your friend Shellbags.

Oh my God, yeah, exactly. So there you go. Once you combine— so the first one you do like the first one greater than sign, then when you run the other one, then you're appending to time.txt. So that will just give you such a beautiful timeline. So then you'll be able to, you know, trace the attacker activity from start to finish. Keep, I think I'm looking for oh LSA dump, hash dump. It could give you hashes again. Very, very intrusive memory. And then I'm looking for the command one, the CMD scan. Keep going down. This malware specific. Actually, if you search for volatility cheat sheet, this is not the only thing that shows up again. So this one is great, but then there are other tools. But if you keep going up a little— oh, this is the Linux part.

You want me to go up?

Yeah. I think there's got to be something for command line, like figuring out what attackers ran via command line. So keep going up now.

There is so much functionality to this thing.

Oh, the screenshot one is great. Pslist, of course, you want to know which processes were running.

Yep. There's got to be here.

But you, you'll find it. Uh, if, if you don't remember it, just type in—

But right here, is it here? Command scan?

Yeah, these 2, uh, gotta run it. And, and I would, you know, if you don't have like an attack box, just run some commands on your Windows computer and then come back and take a memory dump and run this. and you'll just fall in love with this career.

Oh my God, so cool.

This gets so, so interesting, 'cause there's just so many possibilities.

I make like random, you know, I do Simply Cyber, but recently if someone like Eric Capuano makes a lot of like, he made like a prefetch analysis lab and I just like, I was like, ooh, so I just did it and recorded it and made a video so other people could follow it along. Like, I don't know, Jibran, I think there might be a volatility, video coming out pretty soon because this is—

I will tell you this, you know, when you go in interviews, uh, like for your starting DFIR positions, a lot of people look for like, hey, everybody knows artifacts, everybody knows operating system, what are you doing, uh, extra? Uh, so if you have these, uh, windows— I mean, these videos made, it basically proves how deep of an understanding you have on a concept. And that's, that's great showing, uh, seriously. Like, you know, you could have your own blog. Like, all of the things that you're learning today, like, if you keep creating videos of these and, you know, you're in front of a hiring manager and they see your playlist, like, not only this guy knows, he's confident, uh, teaching others. Um, so that's great because you do— nobody knows everything, right? Like, like, some people might be really good at your command line console, right? Like, your rep, offset, um, you know, um, all of that. Some people might be really good at recovering data from systems. So you come together as a team, uh, and that, that's what— that's the beauty of this career, is, um, you rely on other people, other people rely on you, and it's just like that, you know, universe, you know, everybody coming together and solving the puzzle. So if you can teach, that is a great, uh, skill that you can brag about in interviews.

Yeah, no, it really is. Like, you want to talk about demonstrating practical skill? I also want to point out, uh, K Bandwidth said that, that he uses Volatility 3 and those commands didn't work. Um, mods dropped this in, I think it was Jesse. This is Volatility 3 cheat sheet. I put it in chat, but you actually can toggle between Volatility 3 commands and Volatility 2. So this seems like it's probably a little bit more flexible, you know, versatile for people out there who are working on this.

Yeah, if you just search volatility cheat sheet or volatility plugins, there are some custom plugins as well, like that people have on their GitHub. So I would highly recommend those too, because there are some that are by the developers and then some that community contributed. So look at all that. There's probably— Wikipedia page as well on it that has like syntax on how to run certain commands. And then, you know, if you know how to play with the data, right? Like the most— if I could sum up this forensics is that the easier thing is to actually use a tool to dump the data. The hardest thing is to correlate that data. So yes, you'll get all this data, but then, you know, it's your, uh, skill, right, on, uh, you know, your GrabOx, your, you know, combining of data, and, you know, how you play around with that data. Um, so that's step 1, but once you get through step 1, then it's your creativity. Then, then you're just like, okay, how do I, uh, problem solve? And, and the pattern analysis is a great skill. So, you know, if you You know, like, hey, there's this pattern. You know how you do those IQ puzzles? You look at patterns, you're like, okay, well, this doesn't look normal. This, uh, there's a pattern and there's an anomaly. So—

Mensa, Mensa tests.

Yeah, yeah, yeah.

Hey, as a follow-up, uh, it's a good question. Is there any benefit of Volatility 3 over 2?

Like, you want to use the latest and the greatest.

Okay, there you go. K-bandwidth, latest and greatest.

Latest and greatest. Sometimes, like, if something doesn't run, then I go back to the old version of Volatility just to kind of parse something out. But, uh, just general rule of thumb, just try using the latest version of the tools first and then kind of downgrade if you— if need be.

All right. And I— okay, so 2 things. One, Justin Gold said, since we restarted the stream, is it like we're getting another hour? We're not doing another hour, but that is really funny, Justin Gold. Um, Jibran did agree to stay a little bit longer and share a little bit knowledge with everybody. I did lose the questions though because this is effectively a new stream, so all the saved questions I did lose access to. Um, but I did have a couple kind of like written down or jotted down. The mods captured them. Uh, so I'm, I'm scooping for those right now, Jibran, and I'll throw this at you.

Mm-hmm.

Again, this is one I'm not sure if you can answer, but, you know, feel free to deflect if you'd like. How much does Google Tag Group work with Mandiant, and how does that relationship work?

You know, if you had asked me a few months ago, I wouldn't have had an answer. But if you read our latest blog about how Google and Mandiant came together to come up with Google Threat Intelligence, So now there's no TAG, now there's no Mandiant Intelligence. They've combined it, and it is fabulous. So I can share the link, but you've got to read that blog. It will tell you how, like, you know, Google protects about 4 billion devices, right?

Not bad.

With around 1.5 billion email accounts, blocks about 100 million phishing attempts a day. Right? And Mandiant, I don't think anybody in the world can claim 1,000+ investigations a year. And these are not just like onesie-twosie investigations. These are like big enterprise investigations. So 1,000 investigations, and then, you know, Google protecting 4 billion devices, 1.5 billion like email accounts and all that, the magnitude of intelligence that—

Yeah, this is awesome.

you know, we have now is great. Like, I literally, I feel very, I feel like a kid at a candy store. There's just so much. And, you know, whenever I've used the intel and the learnings and I've submitted to conference like RSA, you know, and others, like, you know, it's valued. And so you have a chance, like now, like we submit, we create a lot of blogs, create tools and There's a lot out there publicly, so consume that because, uh, we love sharing information with the community. And that's, that's the biggest thing, and that's, that's the reason I teach. That's the reason why we do this, right? Because we're learning. On one hand, we're taking all this information from the cases, and— but the exciting part is sharing the knowledge back with the community. Like, especially this healthcare, we're just doing so many talks these days, uh, trying to educate the community because You know, I couldn't be a doctor, so here's one way to say it.

Full circle, bringing it back full circle. So speaking of conferences, and I just dropped the blog post that I suspect you're talking about, it looks like it's a, you know, kind of a presser, right? On making the announcement at RSA. What is your, like, you know, obviously you're dropping mad knowledge bombs. We had talked earlier, you might be going to Black Hat and doing something. What kind of— what's your schedule look like for conferences and speaking and opportunities for people to continue to consume more Jibran?

Yeah, I— so right now my subject is ransomware. So I recently did a talk at RSA, which was fortunately voted like top 20 talks of the year.

Nice. Congratulations.

Great. I didn't even know that the audience was so overwhelmed because I had demos. I think that's why. I don't think I did anything special, to be honest. It was different because it had demos. A lot of people say, okay, well, this would happen, that would happen. I basically ran some samples of malware and I showed exactly how it works. Especially somebody clicking on a phishing email attachment in a phishing email, What happens then? What happens— like, I basically showed the attacker's point of perspective. Like, hey, once the command and control establishes, what can they do? And, you know, the possibilities were kind of endless. And then there was a lot of, like, human elements to it as well. It was because, you know, we talked about how attackers bluff. That's a big theme in ransomware. Attackers might claim that they have the whole thing, But in reality, they might just have your file tree with like millions of files, and they kind of say, hey, you know what, you have this file, and people believe them, right? Oh yeah, we have this file. That means they have all the files. But there was a recent investigation where I actually challenged the attacker, and we said, hey, hey, we need these 5 files, and they basically gave only one, and they gave 4 other files. So we caught their bluff. We did all the forensics, and we were able to prove that they only took like 13 files. Um, so that was a big win. Um, that's why a lot of them hate me. Actually, one of them actually had a dark web post. They wanted, uh, my credentials from all the hackers in the world, and there was a $100,000 bounty on me.

Jesus Christ.

Yeah, yeah, yeah. My wife was like, you know what, they could just come to me, I'll give everything. But, uh, yeah, that was scary, uh, because, you know, a lot of people were trying to do Like really advanced attacks, like SIM cloning. And, you know, like lots of things are going on with my account, uh, and it was painful times. But, you know, the thing is, when you're in it for a mission, you don't, you don't feel that pain. You're like, hey, this is nothing compared to all the good that happens when you actually protect your clients, like saving millions of dollars, saving the data, and, you know, advising them.

Right.

Um, so yeah, but that, that That's one of the hazards in this. Like, you know, when you go up against notorious hackers and you protect your clients, they're not too happy with you.

No, I wouldn't think so. I mean, you're effectively eliminating their revenue-generating mechanisms, but it's crime. It's crime. You know what I mean?

I mean, you think about the revenue generation aspect, right? But then there's this whole nation-state threats, right? So revenue generation, you think about it like, you know, if you You are that hacker, you are that attacker, right?

Right.

And you get like some investigator that kicks you out of the network, you go to somebody else. But imagine you're a nation-state and you're given a target that, hey, I need this thing from this network, then you become a more sworn enemy, right? Oh my God, I gotta take care of this guy because this is, you know, he's the one stopping me from my mission. The mission, if it's money, they just move on to the next easier target. But if it's nation-state though, it's, it's pretty serious.

Yeah, I mean, that gives me chills, man, just thinking about it. I mean, it's, as you say it, it's like completely accurate and completely true. It's just I feel like sometimes we get kind of like so focused on the day in, day out, and almost the insulation of like, oh, it's a job, it's a Good job. But yeah, there's real, real people and real consequences and real motivations, I guess, to put it plainly.

I mean, like, the amount of, uh, you know, tools people share. I mean, look at you, you, you do this amazing podcast, right? Like, thank you. You know, the following is, uh, I don't want to say cult following, but there's a lot of followers, right? Yeah. Like, I think that when you first announced me, I had like a DDoS attack on my Seriously, I was like, where are these people coming from? And everybody said, hey, you know, we're looking forward to see you on the podcast. So, you know, because this is such a noble thing, you know, the spirit of sharing, the spirit of teaching, and you do that day in and day out, um, it's one of the most noble things you could do. And you're so blessed that you have such a big community. And I think everybody who's here, uh, who's gonna pass on the baton, you know, when you become good Just pass it on. You love your life.

That's right, man. And that's why we say #TeamSC. It's a Simply Cyber community. Our values are support, inclusion, empowerment, enabling people to, you know, achieve the successes that they want and have. I don't know. I mean, Jibran, you know, I know we've only had a couple conversations and we're new friends, but I do feel that we're kindred spirits in the sense of like, not only do I love cybersecurity, But it has provided a good life for me. It's been able— I've been able to, you know, support my family and achieve the goals that I want. And I want other people to have that opportunity. Like, it's not only a career, but it's like, it's a passion, you know? Oh, it is.

You know, we need people. I mean, people keep talking about like these millions of, you know, positions that we can't fill, but it's It's really about the people who feel the mission. Like, those are the people we can't find, to be honest. And I'm on the hiring front as well. It's really hard for people to find people that are passionate, that are mission-oriented. And that's what you're bringing in, like, the passion. And like, you know, I think the way you value or you evaluate your life is, you know, when you go to bed after a long day, do you feel gratitude? Do you feel like, hey, you accomplished something, right? And Fiverr lets you feel that, right? Because you're helping real people. So I think, you know, for— yes, it pays well and all that, but, you know, the amount of gratitude that you have, the amount of satisfaction that you have in life, it's, uh, it's just so amazing. It makes, um, every day It's such a, you know, a fulfilling day because you're able to contribute to the society.

Absolutely. Wow. I mean, you put like, you put it in a beautiful package. You put like gold gilded wrapping paper on it and a beautiful bow. You captured it perfectly, Jibran. I 100% resonate with that.

Thank you so much.

Oh my God, it's so good. Let's run down the list of tools. Get your pen and paper ready. Mark tape if you're going to have to go back and rewind it. It's— well, I guess this is the DR episode, so you people who managed to migrate over from the original one, you're even in more luck. Let's go ahead and rip through these. There's our friend Jibran Ilyas. This guy, amazing. We talked about Linux Bash history. We talked about Amcache, which I lost the tab for. We talked about Volatility. And don't Sleep on the volatility cheat sheet because you're going to need that as well. I'll drop the links afterwards. Don't worry about that. SRUM for forensic analysis of Windows. This is the one that I think you did on your best friend, right? Or your good friend and totally exposed.

That was a memory. That was a memory. But SRUM can actually be where you're revealing too.

Okay. Okay. We got Hindsight web browser forensics. So You know, grab up your friend's Google Chrome and dump that, see what happens. We've got 2— we got a twofer right here. CAPE is the artifact parser and extractor, but you need to go to Eric Zimmerman's tools here and get, uh, which tool is it that's going to work with that?

So I was mentioning it for like, uh, you know, uh, standalone artifacts, but CAPE can do a lot of automation. It's actually really good. But, uh, if you just want to do one artifact at a time, you can use Eric Zimmerman's tools like Amcache was the artifact that I mentioned, so you've got that. But CAPE could be overwhelming because it's so many artifacts, so many parsing. If you start with Eric Zimmerman's tool to answer a specific question with a specific parser, that could be the start, but CAPE is a little advanced version, if you will. you would do a lot of automation in your data collection and data parsing.

I also want to point out, I'm just reading this now, CAPE was created by Eric Zimmerman, who, who I hadn't heard of before today, but he was Digital Forensics Investigator of the Year. I don't think that that's like out of people in his home. I think that that might be out of the entire cybersecurity industry.

Yeah, it's a— I mean, I have so much respect for the people people who create tools and then share it, uh, for free.

Oh my God, so good.

There was another one called RegRipper, or— oh yeah, an artifact called, uh, yeah, um, I mean, there's— it parses registry, right? Um, software registry hives. But the one thing that I was recommending was the NTUSER.DAT file. So just look for NTUSER.DAT and RegRipper and you'll get Some tutorial, I'm pretty sure, somewhere.

Okay, uh, ntuser.dat. See, we've got— I'm like, dude, I'm your Vanna White. Like, I, I— you say it and I'm, I'm ready to flip the button around and show it to everybody. So ntuser.dat. And don't sleep, we got shellbags. Uh, shellbags, you may not have heard of that if you're new here. I hadn't heard of shellbags. I also hadn't heard of prefetch analysis until last week either, but that doesn't mean anything. Uh, and then finally We got the Volatility plugins, uh, if you want to take your Volatility game to the next level, um, with all the different, you know, plugins here on GitHub.

You've got so many custom plugins.

Jibran, are you doing custom plugin development? Are you doing any coding? You said you had a computer science background. You got the skills, bro. I did.

I, I did the memory ones, uh, those are now outdated, so I gotta port it over to Like the latest ones, but I, uh, kind of coded for a company that I was working for, so I don't— I wasn't allowed to take that IP with me.

Oh no, that was frowned upon.

But yeah, you do it on company's time here.

No, I, I got you. All right, well, um, dude, amazing. Any final thoughts? Because I, I like— now I'm currently dumping all of these. The only way I know how to do it is to dump them in chat one after another, so Yeah, Jibran, I will tell you, people are, people are clamoring for you. Like, one person actually suggested that you replace me, um, as the host of this show. So I don't know if that's gonna happen, but—

You're too good. But, uh, yeah, I'd say final thoughts, there's just so many resources, right? So just like if you go to RSA conference website, you could actually see, or their YouTube channel, you could see the talks for free. So the talk that I've been talking about from last year the one that got top 20 award. Just look at that. It's kind of like your ransomware sum-up from like a year and a half ago. I'm planning to submit another one at RSA next year, so that will be the 2025 version of like what's happening in ransomware world. And then, you know, if you are interested in submitting a talk, there is an interview that I did with RSA where they actually asked me how I— my journey on like top 20 talks, because I was probably— I think they said I was the only one who applied 2 times and I got in the 2 times. So I basically explain what are my criteria before I submit a talk. So it's like a 10-15 minute interview. But so if you're trying to speak at a conference, like that is a good thing to learn or good.

Is that already out right now? Is that—

Yeah, it's on It's on RSA channel. It's on my LinkedIn as well. So if you, uh, probably like a few posts, a few screens down on my LinkedIn. Uh, and yeah, I would say this, I am— I love this field and I love teaching. So you, uh, connect me on LinkedIn if you have quick questions about resources. I'll, I'll, uh, share them right away. You at least have the guidance of where to go. And, um, I think there are so many things that you can learn from like these really long like Medium blogs and whatnot, but I do this, uh, you know, 2 times a year at Western when I teach the class, so I have these resources on my fingertips. So I can give you that right away, and I'll be so happy if I'm able to make an impact in your life, and then I'll continue to pass that on. So Yeah, so, so there, if you follow all the companies that are doing incident response, uh, and follow their blogs and their Twitter and their social media fields, you'll, you'll actually speak that lingo that we speak. So you'll be so familiarized with this world that, uh, you know, when you go to the interview to any company, you'll actually be speaking their language and they'll be like, how come this guy or this gal knows all of that? And And, you know, that sets you apart because basic, everybody does, right? So don't— the last thing I'll say is that don't be mediocre. Just, uh, shoot for the stars because you're special. You'll achieve it. You just have to believe it.

Oh my God, so inspiring. I know a lot of people are in here about ready to get up and run through a wall, uh, from that, from that inspirational speech. Uh, ladies and gentlemen, we've been talking with Jibran Ilyas across 2 streams. An hour and a half. The man— I dropped 15 links in chat. Tons of inspiration, tons of intel for people starting a career, for people crushing a career. I know there's people who are active in SecOps right now getting value from the stream. Jibran, thank you so very much for coming on, for sharing your insights, your knowledge. It, it was, it was unbelievably valuable. Thank you. Thank you very much.

Thank you. Thank you. And thank you to everybody who gave us so much love before I came to the podcast. Um, you know, folks made my day several times in the last few days. So, um, it just feels great that the community is getting bigger and bigger. And, uh, I'm— I just, um, feel blessed to be on your podcast. And thank you for all that you do. Thank you for having me.

Absolutely. Well, well, we'll definitely consider you officially #TeamSC member. Uh, and, uh, you know, we'll have to get you back on here. Uh, we do special guests, we do bring back and ask to come back. Uh, and I would definitely love to extend that, uh, opportunity to you.

All right, everybody. Thank you.

All right, cool. All right, everybody, so just remember tonight at 7 PM Eastern time, so 56 minutes from now, on Slay Security+ YouTube. Jesse Johnson, he's one of the mods, he's in chat right now. If you're studying for Security+, Trust me, you're going to want to go check out that stream. It's awesome. That's like live questions, live feedback, great community. I think Casually Joseph's hosting tonight because Jesse's got a little bit of, uh, under the flu. But on behalf of Jibran, myself, thank you, Chad, for being here. On behalf of Chad, Jibran, thank you for being here. Everybody be good, and until next time, stay secure. Content— keep the cybersecurity train going by connecting with the other Simply Cyber community resources. We have the Discord server that's lively and always keeps the conversation going. You can connect with me directly on LinkedIn. And also every single weekday morning on the Simply Cyber channel, we're doing live daily cyber threat briefings, 8 AM Eastern time, as well as Thursday at 4:30 PM, we're doing livestream interviews with industry experts. And we produce videos that we push out every Wednesday morning. I'm Jerry from Simply Cyber. I hope you enjoyed the content and we'll see you next time.