Pinned Tweet
A few months of behind-the-scenes work is now ready to share with the world! The official EZ Tools Manuals are now available to the public!
Grab the book - leanpub.com/eztoolsmanuals
Check out the source code for the book - github.com/EZToolsManuals/EZ…
#eztoolsmanuals #dfir #eztools
Andrew Rathbun retweeted
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
github.com/AndrewRathbun/KAP… has been updated, as well!
1/ EZ Tools 2026.10 is out, all on .NET 10 (LTS)
✅ More accurate: 331K more event log records, hive logs replayed as Windows does, every test hive loads
⚡ Faster: up to 9x; EvtxECmd and Registry 2x
📉 Less memory: up to 82% less
Update with Get-ZimmermanTools 🧵 #DFIR
Andrew Rathbun retweeted
1/ EZ Tools 2026.10 is out, all on .NET 10 (LTS)
✅ More accurate: 331K more event log records, hive logs replayed as Windows does, every test hive loads
⚡ Faster: up to 9x; EvtxECmd and Registry 2x
📉 Less memory: up to 82% less
Update with Get-ZimmermanTools 🧵 #DFIR
Andrew Rathbun retweeted
HUGE news about the October release of EZTools is coming soon! You wont believe your eyes! #DFIR
Andrew Rathbun retweeted
Paid opportunities for cybersecurity professionals of all specialties and experience levels, we have two great opportunities to introduce you to CyberStudio by SANS, a new training platform now in development. (Yes, I am writing a course for this!)
Beta testing: For professionals based anywhere in the United States, we invite you to test drive CyberStudio and participate in a follow-up interview (online) to share your thoughts.
When: 9/21 through 10/26
Register to be a beta tester at survey.sans.org/jfe/form/SV_…
Focus group: For professionals in the Las Vegas area, we’d love for you to join us in-person at Caesars Palace to get an introduction to CyberStudio and share your thoughts.
When: Thursday, 9/24, evening (1–2 hours)
Where: Caesars Palace, Las Vegas
Register for the focus group at app.smartsheet.com/b/form/01…
Focus group attendees and beta testers will be compensated! Thanks in advance.
Andrew Rathbun retweeted
🧟 Abeebus is back from the dead. v2.1 is out.
It pulls IPv4 addresses out of any file and gets GeoIP data for each one from ipinfo.io.
🔧 The big fix: it used to read the entire file into memory. Fine for email headers, not so great for a memory image. It streams now.
Also keeps your results if you hit the ipinfo.io rate limit.
If you prefer a native Windows binary, try SharpAbeebus.
github.com/13Cubed/Abeebus
github.com/13Cubed/SharpAbee…
Andrew Rathbun retweeted
The first 13Cubed mini course, Architecting the Hunt, is now available! 🎉
An entry-level, hands-on introduction to threat hunting, learn a repeatable framework, then put it to work in a self-contained lab. No prior experience needed.
Watch the launch video 👉 youtube.com/watch?v=cFxwYz5T…
Enroll 👉 training.13cubed.com/archite…
#ThreatHunting #DFIR #BlueTeam
Andrew Rathbun retweeted
The very first 13Cubed mini course is coming, and we couldn't be more excited! 🔥
🎯 Architecting the Hunt takes you from zero to confident threat hunter with a repeatable framework, then drops you into a hands-on lab with 100 hosts and 9M+ events to hunt through. 🕵️
✅ Entry-level
✅ Hands-on lab (yours to keep!)
✅ No experience needed
The waitlist is OPEN 👇
training.13cubed.com/archite…
Andrew Rathbun retweeted
The Weather Channel has started letting you opt into a retro version of the forecast, and it's delightful. Includes the music and everything.
weather.com/retro/
Andrew Rathbun retweeted
The Evidence Locker has been updated!
- 6 challenges from @RedHatPentester (Vehicle triages, network captures, Windows and more)
- Jimmy Wilson test image
theevidencelocker.github.io/
Do you have more that you want included? Check out the "New Submission" button on the page or send me a DM. #DFIR #MobileForensics
Andrew Rathbun retweeted
🎉 A new 13Cubed episode is up!
This time we're exploring the USN Journal on a live system. How can we view it while Windows is actively running, and does the reality match the common explanations? Let's find out!
youtube.com/watch?v=eSLHyqZl…
#DFIR #DigitalForensics
Andrew Rathbun retweeted
Really enjoyed this interview by @elijahwoodward9 with @bunsofwrath12 on Team Cymru’s “Future of Threat Intelligence”
A lot of good DFIR points in there that often get ignored in enterprise envs:
- why default Win event log sizes are a forensic disaster
- why Sysmon deployments are often stale or incomplete
- the forensic value of Volume Shadow Copies and the $J USN Journal
- why EDR alone is not enough
- how true positives get buried in alert fatigue
- using AI as a force multiplier for parsing logs and writing one-off tooling, while still not treating it as forensic ground truth
Also liked the practical angle throughout the whole discussion. Felt very experience-driven, not theoretical.
Worth watching
youtu.be/4KF9jkoM0V4?is=8SMf…
Andrew Rathbun retweeted
All EZ Tools have been updated! New version is 2026.5.0 across the board.
Nuget updates, control updates, bug fixes and general refreshing of everything.
Enjoy!!
#dfir
Andrew Rathbun retweeted
We are pleased to announce the release of macos-collector v1.6.0! 🚀
Notification Center Database File Collection, Paste Protection, and XProtect Version Check added. Happy macOS Threat Hunting!
github.com/LETHAL-FORENSICS/…
Andrew Rathbun retweeted
New t-shirt designs are now in stock at shop.13cubed.com. This one is our favorite! 😍
Andrew Rathbun retweeted
A New #DFIR Peer-reviewed article has been published on @DFIRReview by "Is that Windows Notepad window really empty?" by Christopher Eng.
#WindowsForensics #DigitalForensics
dfir.pubpub.org/pub/wmhy8t6v…
Andrew Rathbun retweeted
🚨OPEN NOW! The @EricRZimmerman #EZToolChallenge at #DFIRCON is accepting submissions! Got a #DFIR tool idea? 🛠️ Submit it by 8/29. Eric will unveil the winner during his keynote!
👉 Submit: sans.org/u/1CrZ
🔎 DFIRCON: sans.org/u/1Cs4
I just backed Digital Forensics Discord Challenge Coin on @Kickstarter kickstarter.com/projects/off…
Andrew Rathbun retweeted
We just issued our 500th 13Cubed certification! 🎉 Learn more at 13cubed.com/certs. All Windows, Linux, and macOS courses include certification attempts at no extra cost, allowing you to demonstrate real-world practical application of forensic investigative techniques. 🏅
