Allaianalysisappcompatcacheartifactscollectioncollectordetectionencaseforensicsguideincident-responseiocmalwareparser-bugsplaybooksecurityshimcachetutorialwindowsworkflowyara
malwareforensicsioc
Why Malware Results Should Connect Back to the Forensic Case
How IOC, behavior, and time data from Malware Lab results improve forensic case analysis and reporting.
May 30, 20268 min
unJaena Team
forensicsincident-responseai
Forensic Lab Questions Incident Responders Actually Ask
Practical natural-language questions for incident traces, exfiltration, personal data exposure, and insider-risk investigations.
May 30, 20269 min
unJaena Team
windowsshimcacheappcompatcache
Windows 10/11 ShimCache `10ts`: the 1-byte trap that silently returns zero records
If your forensic pipeline parses AppCompatCache with a 3-byte 'sts' signature search, it returns zero records on every Windows 10 1607+ image. Here is the byte-layout mistake, the second mistake right next to it, and how to verify your own parser in five minutes.
May 1, 20268 min
unJaena Team