InfoSecNirvana

I plan to do more updates on my Twitter feed  @ nairsaj . When I have more content to write about, I will post it here.

MsiInstaller events. Applications that use Windows Installer logs both installation and removal events; these are available on the '...

MS Office Trust Records. When documents are downloaded from untrusted sources, a "trust" prompt is shown to the user when th...

Typed URLs - alternate location. The main script LRUP already contain many IE related artifacts; here is one more that we can add to t...

The main LRUP code lists many event logs that are useful in an incident response scenario. In this section, let's look some additional...

Quickly identify a login event.     Get-WinEvent -FilterHashtable @{Logname='security';ID=4624} | ft -auto -wrap Quickly iden...

Identify currently logged in user. If the requirement is to get only the logged in user along with the time of login then use " w...

Have received many questions offline on the use of PowerShell and how we can get the desired artifacts from Windows system. While I have re...

One of the requests I got was to combine the output of all the text files and compress it so that a single file can be sent by the user fro...

Code used in the paper is now available from the CodePlex site. https://infosecnirvana.codeplex.com/ This is a version 2.0, which is o...