All categories

// dfir

DFIR Projects

Digital forensics, memory analysis, and incident response.

DFIR Phishing Investigation — The Boogeyman Malware Case Study

Completed

Full DFIR investigation of a phishing-based malware compromise targeting an HR employee at Quick Logistics LLC. Reconstructed the attack chain from a malicious Word doc with VBA macros to C2 communication and persistence.

DFIRVolatility 3OlevbaMemory ForensicsMalware AnalysisVBA Macros

Investigation focus

Analysed a malicious Microsoft Word attachment containing VBA macros that downloaded and executed additional malware payloads on the victim workstation. Used memory forensics and malware analysis to reconstruct process execution, command-and-control (C2) communication, persistence mechanisms, and indicators of compromise (IOCs).

Areas covered

  • Phishing email analysis
  • VBA macro analysis
  • Memory forensics
  • Process and network analysis
  • Persistence investigation
  • IOC extraction
  • Threat hunting methodologies
  • Incident response documentation

Technologies & tools

  • Volatility 3
  • Olevba
  • Linux CLI
  • Memory Forensics
  • Malware Analysis
View repository

KDiff3 Configuration Drift Analysis Lab

Completed

Detection of file integrity changes and configuration drift using 3-way merge comparison with KDiff3.

File IntegrityKDiff3Drift Detection

What I did

  • Compared baseline, production, and modified configs with 3-way merge.
  • Identified unauthorized changes and validated integrity of critical files.
  • Documented drift patterns relevant to forensic timeline reconstruction.

SIFT Workstation Installation Lab

Completed

Setup and configuration of a SANS SIFT-based forensic analysis environment.

SIFTLinuxForensics Workstation

What I did

  • Installed and hardened a SIFT Workstation for DFIR casework.
  • Validated forensic tooling (Volatility, Autopsy, Sleuth Kit, plaso).
  • Prepared a repeatable build for future investigations.