Repository navigation
Expand file tree
/
Copy pathindex.xml
More file actions
183 lines (139 loc) · 25.8 KB
/
Copy pathindex.xml
File metadata and controls
183 lines (139 loc) · 25.8 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Home on Matthew Green | DFIR, Threat Intelligence & Research</title><link>https://dfir.au/</link><description>Recent content in Home on Matthew Green | DFIR, Threat Intelligence & Research</description><generator>Hugo</generator><language>en-US</language><lastBuildDate>Mon, 28 Sep 2026 00:00:00 +0000</lastBuildDate><atom:link href="https://dfir.au/index.xml" rel="self" type="application/rss+xml"/><item><title>GUI mode and lab setup</title><link>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/gui-mode/</link><pubDate>Mon, 20 Nov 2023 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/gui-mode/</guid><description><h2 class="heading" id="objective">
<strong>Objective</strong>
<a href="#objective">#</a>
</h2>
<p>This lab is a guided walk-through for running Velociraptor in GUI mode.</p>
<p>GUI mode will be used throughout the workshop.</p>
<p>We also walk through importing additional content into Velociraptor.</p>
<p>The Velociraptor GUI is configured to open automatically upon boot, but the credentials are available below:</p>
<ul>
<li>URL: <a href="https://127.0.0.1:8889/"><code>https://127.0.0.1:8889/</code></a></li>
<li>Username: <code>admin</code></li>
<li>Password: <code>password</code></li>
</ul>
<h2 class="heading" id="dependencies">
<strong>Dependencies</strong>
<a href="#dependencies">#</a>
</h2>
<p>Windows 10+ VM with administrator level access.</p>
<ul>
<li>UEFI enabled for UEFI use cases (detail later)</li>
</ul>
<p>Internet access if you would like to do content import.</p></description></item><item><title>VQL and accessors</title><link>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/vql-accessors/</link><pubDate>Mon, 20 Nov 2023 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/vql-accessors/</guid><description><h2 class="heading" id="objective">
<strong>Objective</strong>
<a href="#objective">#</a>
</h2>
<p>This lab is an introduction to help understand how Velociraptor can access data.</p>
<p>GUI mode will be used throughout the workshop. We will be using VQL plugins and running queries against various accessors to compare the results.</p>
<p>This is a fairly long lab best suited to newer users, feel free to skip a head if you have good understanding of VQL and how it can interact with Windows systems.</p></description></item><item><title>VQL performance and YARA</title><link>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/vql-yara-performance/</link><pubDate>Mon, 20 Nov 2023 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/vql-yara-performance/</guid><description><h2 class="heading" id="objective">
<strong>Objective</strong>
<a href="#objective">#</a>
</h2>
<p>This lab is an introduction to look at Velociraptor performance when using yara.</p>
<p>We will be walking through the best way to run Velociraptor queries with a few different use cases.</p>
<h2 class="heading" id="dependencies">
<strong>Dependencies</strong>
<a href="#dependencies">#</a>
</h2>
<p>Velociraptor available on the desktop to run as per <a href="https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/gui-mode/">Lab: GUI mode walk through</a></p>
<p>Open cmd, browse to desktop and run: <code>velociraptor .exe gui –-datastore=./VRdata -v</code></p>
<p>The Velociraptor GUI is configured to open automatically upon start, but the credentials are available below:</p></description></item><item><title>Patched RDP</title><link>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/patched-rdp/</link><pubDate>Mon, 20 Nov 2023 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/patched-rdp/</guid><description><h2 class="heading" id="objective">
<strong>Objective</strong>
<a href="#objective">#</a>
</h2>
<p>This lab is a walkthrough of the patched Terminal Services DLL use case - <a href="https://attack.mitre.org/techniques/T1505/005/">T1505.005</a>. We will firstly replicate the scenario, then walk through how I would build a cross artifact detection using Velociraptor.</p>
<h2 class="heading" id="dependencies">
<strong>Dependencies</strong>
<a href="#dependencies">#</a>
</h2>
<p>VM with internet access and Velociraptor available on the desktop to run as per <a href="https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/gui-mode/">Lab: GUI mode walk through</a></p>
<p>Artifact Exchange content has been imported into your Velociraptor instance - <a href="https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/gui-mode/">Lab: GUI mode walk through</a></p></description></item><item><title>UEFI and BlackLotus</title><link>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/uefi-blacklotus/</link><pubDate>Mon, 20 Nov 2023 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/uefi-blacklotus/</guid><description><h2 class="heading" id="objective">
<strong>Objective</strong>
<a href="#objective">#</a>
</h2>
<p>This lab is a walkthrough of Velociraptor UEFI visibility and simulation on how we would deploy capability to detect BlackLotus from a technical detection article.</p>
<ol>
<li>Generic Velociraptor visibility from the Windows EFI API.</li>
<li>Install BlackLotus malware sample.</li>
<li>We will walk through several detection capabilities for BlackLotus style attacks that can be used at scale via Velociraptor.</li>
</ol>
<h2 class="heading" id="dependencies">
<strong>Dependencies</strong>
<a href="#dependencies">#</a>
</h2>
<p>VM with UEFI installed. I have also added a task below to walk through this process.</p></description></item><item><title>LNK analysis</title><link>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/lnk-analysis/</link><pubDate>Mon, 20 Nov 2023 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/lnk-analysis/</guid><description><h2 class="heading" id="objective">
<strong>Objective</strong>
<a href="#objective">#</a>
</h2>
<p>Since Microsoft announced that Office applications will block macros from the Internet, adversaries have adapted their initial access techniques. This lab will walk through ****analysis of one of these techniques: LNK files with an embedded decoy document and a payload.</p>
<p>We will run some analysis using Velociraptor, then consider methods to detect at scale.</p>
<h2 class="heading" id="dependencies">
<strong>Dependencies</strong>
<a href="#dependencies">#</a>
</h2>
<p>VM with internet access and Velociraptor available on the desktop to run as per <a href="https://dfir.au/projects/deathcon2023-practical-death-by-velociraptor/gui-mode/">Lab: GUI mode walk through</a></p></description></item><item><title>AI Ate My Velociraptor</title><link>https://dfir.au/posts/2026/ai_ate_my_velociraptor/</link><pubDate>Mon, 28 Sep 2026 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2026/ai_ate_my_velociraptor/</guid><description>Introducing velociraptor-skills, reusable AI skills for case setup, collection, hunting and evidence analysis with Velociraptor.</description></item><item><title>Velociraptor Skills</title><link>https://dfir.au/projects/velociraptor-skills/</link><pubDate>Mon, 28 Sep 2026 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/velociraptor-skills/</guid><description><p>Reusable AI skills and DFIR tooling for Velociraptor setup, artifact selection, collection, hunting and host analysis. Includes the shared <code>vraptor</code> command-line runtime, installation helpers and agent templates.</p>
<p><a href="https://github.com/ig-labs/velociraptor-skills">GitHub repository</a> · <a href="https://labs.infoguard.ch/posts/ai_ate_my_velociraptor/">Introducing Velociraptor Skills: AI Ate My Velociraptor</a></p></description></item><item><title>CLRaptor: Hunting reflected assemblies with Velociraptor</title><link>https://dfir.au/posts/2025/clraptor_hunting_for_assemblies/</link><pubDate>Mon, 01 Dec 2025 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2025/clraptor_hunting_for_assemblies/</guid><description>Hunt reflected .NET assemblies at scale with Velociraptor, detect CLR visibility gaps, and dump suspicious in-memory assemblies for analysis.</description></item><item><title>MCP Velociraptor</title><link>https://dfir.au/projects/mcp-velociraptor/</link><pubDate>Tue, 15 Apr 2025 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/mcp-velociraptor/</guid><description><p>A Model Context Protocol bridge that connects AI assistants to Velociraptor for DFIR workflows.
<a href="https://github.com/mgreen27/mcp-velociraptor">GitHub repository</a></p></description></item><item><title>Finding the LNK: Techniques and methodology for advanced analysis</title><link>https://dfir.au/posts/2024/finding_the_lnk/</link><pubDate>Fri, 01 Nov 2024 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2024/finding_the_lnk/</guid><description>Advanced LNK analysis with Velociraptor, covering shortcut structures, suspicious fields, and useful clustering points for DFIR and CTI workflows.</description></item><item><title>Kimsuky's Phishing and Payload Tactics</title><link>https://dfir.au/posts/2024/kimsuky-phishing-payload-tactics/</link><pubDate>Tue, 16 Jul 2024 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2024/kimsuky-phishing-payload-tactics/</guid><description>My 2024 Rapid7 research with Natalie Zargarov and Anna Širokova on Kimsuky&rsquo;s social engineering, delivery methods and payloads.</description></item><item><title>How To Hunt For UEFI Malware</title><link>https://dfir.au/posts/2024/uefi/</link><pubDate>Thu, 29 Feb 2024 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2024/uefi/</guid><description>UEFI malware hunting with Velociraptor, including firmware visibility, collection approaches, and artifacts for field investigation.</description></item><item><title>Content Management Like a Boss!</title><link>https://dfir.au/projects/content-management-like-a-boss/</link><pubDate>Wed, 13 Sep 2023 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/content-management-like-a-boss/</guid><description><p>Content management is one of the most under rated Velociraptor capabilities used by mature users. This talk will walk through some basics of content management, introduce automation and hopefully leave you with actionable ideas on how to do Velociraptor Content like a boss.</p>
<p><div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;">
<iframe allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share; fullscreen" loading="eager" referrerpolicy="strict-origin-when-cross-origin" src="https://www.youtube.com/embed/DjMAri17-MI?autoplay=0&amp;controls=1&amp;end=0&amp;loop=0&amp;mute=0&amp;start=0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" title="YouTube video"></iframe>
</div>
<em>Presentation</em></p></description></item><item><title>Automating Qakbot decode at scale</title><link>https://dfir.au/posts/2023/qakbot/</link><pubDate>Wed, 05 Apr 2023 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2023/qakbot/</guid><description>Extract Qakbot configuration data and automate decoding at scale with Velociraptor. Covers payload unpacking, decryption and campaign indicators.</description></item><item><title>DetectRaptor</title><link>https://dfir.au/projects/detectraptor/</link><pubDate>Thu, 17 Nov 2022 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/detectraptor/</guid><description><p>A repository to share publicly available bulk Velociraptor detection content in an easy to consume way.</p>
<p><a href="https://github.com/mgreen27/DetectRaptor">GitHub repository</a></p></description></item><item><title>DEATHcon 2022 Velociraptor workshop</title><link>https://dfir.au/projects/deathcon-2022-velociraptor-workshop/</link><pubDate>Sat, 05 Nov 2022 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/deathcon-2022-velociraptor-workshop/</guid><description><p>DEATHcon Velociraptor workshop was held November 2022. We cover some basic VQL use cases including NTFS, Event Logs, Yara and memory artifacts.</p>
<p>The workshop was implemented with Velociraptor 0.6.6 although the data generation can be applied to any version.</p>
<p><a href="https://gist.github.com/mgreen27/05f95f27f70234ea7242190c5c62a62a">Data generation scripts </a></p>
<p><div id="Container"
style="padding-bottom:56.25%; position:relative; display:block; width: 100%">
<iframe id="googleSlideIframe"
width="100%" height="100%"
src="https://docs.google.com/presentation/d/1HRIjfPXxSu95tfkyCs7PNqQon1HTeHTz-sQ4-wdWlNA/embed"
frameborder="0" allowfullscreen=""
style="position:absolute; top:0; left: 0"></iframe>
</div>
<em>Workshop slides</em></p>
<p><div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;">
<iframe allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share; fullscreen" loading="eager" referrerpolicy="strict-origin-when-cross-origin" src="https://www.youtube.com/embed/LZYeL3AKXvs?autoplay=0&amp;controls=1&amp;end=0&amp;loop=0&amp;mute=0&amp;start=0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" title="YouTube video"></iframe>
</div>
<em>Workshop introduction</em></p></description></item><item><title>Notebook and VQL - data munging your way to victory!</title><link>https://dfir.au/projects/notebook-and-vql-data-munging-your-way-to-victory/</link><pubDate>Sat, 17 Sep 2022 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/notebook-and-vql-data-munging-your-way-to-victory/</guid><description><p>Velociraptor notebook is a feature that supercharges analysis and speeds up many components of incident response. New users are often intimidated by advanced VQL and don’t know where to start. This talk aims to shed some light on data manipulation in VQL and provide some practical examples that can be taken away for better artifacts and analysis.</p>
<p><div id="Container"
style="padding-bottom:56.25%; position:relative; display:block; width: 100%">
<iframe id="googleSlideIframe"
width="100%" height="100%"
src="https://docs.google.com/presentation/d/1Ev1o3nDmTyejOj2RDjiscRvV_SeS0E90ygrlZU0wsig/embed"
frameborder="0" allowfullscreen=""
style="position:absolute; top:0; left: 0"></iframe>
</div>
<em>Presentation slides</em></p>
<p><div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;">
<iframe allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share; fullscreen" loading="eager" referrerpolicy="strict-origin-when-cross-origin" src="https://www.youtube.com/embed/VoO7y65TOsE?autoplay=0&amp;controls=1&amp;end=0&amp;loop=0&amp;mute=0&amp;start=0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" title="YouTube video"></iframe>
</div>
<em>Presentation</em></p></description></item><item><title>WMI Event Consumers: what are you missing?</title><link>https://dfir.au/posts/2022/wmi-eventing/</link><pubDate>Wed, 12 Jan 2022 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2022/wmi-eventing/</guid><description>Find WMI event consumers that common collection methods miss, including persistence in custom namespaces. Covers collection and detection with Velociraptor.</description></item><item><title>Cobalt Strike Payload Discovery And Data Manipulation In VQL</title><link>https://dfir.au/posts/2021/cobaltstrike_vql/</link><pubDate>Tue, 09 Nov 2021 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2021/cobaltstrike_vql/</guid><description>Discover encoded Cobalt Strike payloads in MSBuild task files, collect them with Velociraptor and use VQL to decode payloads and extract indicators.</description></item><item><title>Windows IPSEC for endpoint quarantine</title><link>https://dfir.au/posts/2020/ipsec/</link><pubDate>Thu, 23 Jul 2020 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2020/ipsec/</guid><description>Build and deploy Windows IPsec policies for endpoint quarantine through Velociraptor, with containment requirements and policy removal considerations.</description></item><item><title>Local Live Response with Velociraptor ++</title><link>https://dfir.au/posts/2019/local_liveresponse_with_vr/</link><pubDate>Sun, 08 Dec 2019 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2019/local_liveresponse_with_vr/</guid><description>A historical walkthrough of bundling Velociraptor with WinPMem and Autoruns for local triage. This approach was superseded by the GUI collector builder.</description></item><item><title>Live response automation with Velociraptor</title><link>https://dfir.au/posts/2019/liveresponse_with_vr/</link><pubDate>Sun, 10 Nov 2019 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2019/liveresponse_with_vr/</guid><description>A historical walkthrough of automating Velociraptor collections and post-processing through its API. The examples predate the current API.</description></item><item><title>Endpoint Hunting in an AntiEDR World</title><link>https://dfir.au/projects/endpoint-hunting-in-an-antiedr-world/</link><pubDate>Wed, 26 Jun 2019 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/endpoint-hunting-in-an-antiedr-world/</guid><description><p>With the proliferation of EDR we have seen attackers at all levels upping their game to bypass brittle (and not so brittle) endpoint detection. This talk showcases the background to EDR technology and some practical real world examples of detection bypasses.</p>
<p><a href="https://github.com/mgreen27/mgreen27.github.io/raw/master/static/talks/2019-06-26-AntiEDR.pdf">
<figure class=" img-small">
<div>
<img loading="lazy" alt="" src="https://dfir.au/projects/endpoint-hunting-in-an-antiedr-world/hunting.png#small" width="439px" height="436px">
</div>
<div class="caption-container">
<figcaption> Download slides </figcaption>
</div>
</figure>
</a></p>
<p>Originally presented at a local SANs and community event (modification with additional presentations since).</p></description></item><item><title>O365: Hidden InboxRules</title><link>https://dfir.au/posts/2019/o365_hiddenrules/</link><pubDate>Sun, 09 Jun 2019 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2019/o365_hiddenrules/</guid><description>Examine how Office 365 inbox rules can be hidden, how rule properties are modified, and methods for detecting the changes.</description></item><item><title>Binary Rename 2</title><link>https://dfir.au/posts/2019/binaryrename2/</link><pubDate>Wed, 29 May 2019 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2019/binaryrename2/</guid><description>Compare YARA and PowerShell approaches to finding renamed executables on disk, with code examples and detection limitations.</description></item><item><title>Blue Team Hacks - Binary Rename</title><link>https://dfir.au/posts/2019/binaryrename/</link><pubDate>Sun, 12 May 2019 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2019/binaryrename/</guid><description>Detect renamed Windows binaries by comparing executable metadata with process names and paths. Includes a proof of concept and its limitations.</description></item><item><title>Live Response Script Builder</title><link>https://dfir.au/posts/2019/invoke-liveresponse_builder/</link><pubDate>Sun, 07 Apr 2019 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2019/invoke-liveresponse_builder/</guid><description>Build modular live response scripts with Invoke-LiveResponse, including custom collection logic and support for legacy PowerShell.</description></item><item><title>Powershell Download Cradles</title><link>https://dfir.au/posts/2018/downloadcradle/</link><pubDate>Mon, 02 Apr 2018 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2018/downloadcradle/</guid><description>Compare PowerShell download cradles and their network and endpoint traces, with test scripts to help assess detection coverage.</description></item><item><title>Sharing my BITS</title><link>https://dfir.au/posts/2018/sharing_my_bits/</link><pubDate>Sun, 18 Feb 2018 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2018/sharing_my_bits/</guid><description>Investigate Microsoft BITS job artefacts, collection methods and event logs to identify suspicious transfers and persistence.</description></item><item><title>Invoke-LiveResponse</title><link>https://dfir.au/posts/2018/invoke-liveresponse/</link><pubDate>Sun, 14 Jan 2018 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2018/invoke-liveresponse/</guid><description>Collect live response data and raw files over WinRM with Invoke-LiveResponse and PowerForensics. Covers setup, collection modes and forensic footprint.</description></item><item><title>Invoke-LiveResponse</title><link>https://dfir.au/projects/invoke-liveresponse/</link><pubDate>Sun, 14 Jan 2018 00:00:00 +0000</pubDate><guid>https://dfir.au/projects/invoke-liveresponse/</guid><description><p><a href="https://github.com/mgreen27/Invoke-LiveResponse">Invoke-LiveResponse</a> is a Powershell module I put together to enable raw disk collections over WinRM and local script execution. Leveraging Powerforensics via a custom Powershell function it enabled collections of key forensic artefacts and stdout of script results typical for live response tasks.</p>
<p><a href="https://github.com/mgreen27/Invoke-LiveResponse">
<figure class="">
<div>
<img loading="lazy" alt="" src="https://dfir.au/projects/invoke-liveresponse/powershell.png" width="1229px" height="612px">
</div>
<div class="caption-container">
<figcaption> See Invoke-LiveResponse on Github </figcaption>
</div>
</figure>
</a></p></description></item><item><title>Blue Team Hacks - WMI Eventing</title><link>https://dfir.au/posts/2017/wmi_eventing/</link><pubDate>Mon, 03 Apr 2017 00:00:00 +0000</pubDate><guid>https://dfir.au/posts/2017/wmi_eventing/</guid><description>Use WMI event subscriptions to monitor processes and trigger file collection on older Windows systems with visibility gaps.</description></item><item><title>PowerShell Remoting and Incident Response</title><link>https://dfir.au/posts/2017/powershell_remoting_ir/</link><pubDate>Thu, 12 Jan 2017 12:00:00 +1000</pubDate><guid>https://dfir.au/posts/2017/powershell_remoting_ir/</guid><description>Use PowerShell remoting and WinRM for incident response, with setup examples, collection options and operational considerations.</description></item><item><title>About</title><link>https://dfir.au/about/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://dfir.au/about/</guid><description><p>I’m an Australian cybersecurity professional focused on DFIR, threat intel and research.</p>
<p>I’ve worked in in-house security, vendor and consulting roles across a broad range of industries. My experience spans presales, consulting delivery, security operations, incident response, research and software engineering, including technical leadership.</p>
<p>My interests centre on adversary behaviour, malware and technical intrusion analysis. I combine that research with Windows forensics, threat hunting and detection engineering. I also explore practical applications of AI and automation in DFIR and threat intelligence workflows.</p></description></item><item><title>Get in touch</title><link>https://dfir.au/contact/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://dfir.au/contact/</guid><description><p>Email <a href="mailto:matt@dfir.au">matt@dfir.au</a> or contact me through <a href="https://www.linkedin.com/in/mgreen27/">LinkedIn</a>. I’m based in Australia.</p>
<p>Questions about an article or open-source project are welcome. Include a link and a short description so I can understand the context.</p>
<p>You can also find my work on <a href="https://github.com/mgreen27">GitHub</a> or reach me on <a href="https://x.com/mgreen27">X</a>.</p>
<h2 class="heading" id="consulting-enquiries">
Consulting enquiries
<a href="#consulting-enquiries">#</a>
</h2>
<p>For investigation support, independent technical review or help developing tools and workflows, include a short description of the problem, your expected timeframe and any important constraints.</p></description></item></channel></rss>