Linux Triage Collection with UAC Full disk imaging does not scale across a compromised estate. This guide covers Linux triage collection with UAC, including profiles, artefact selection, the staging trap and how to search what comes back.

Linux Triage Collection with UAC

Full disk imaging does not scale across a compromised estate. This guide covers Linux triage collection with UAC, including profiles, artefact selection, the staging trap and how to search what comes back.

halkynconsulting.co.uk

DFIR tip: `/proc/PID/exe` is a symbolic link to the process executable. `readlink /proc/PID/exe` may expose a replaced or deleted path, but access depends on ptrace permissions and the process still existing.

Endianness: Why Byte Order Matters in DFIR A four-byte field read in the wrong order gives a plausible answer that is completely false. This guide covers big and little endian, how xxd and hexdump render byte order differently, and why XFS superblocks are big-endian.

Endianness: Why Byte Order Matters in DFIR

A four-byte field read in the wrong order gives a plausible answer that is completely false. This guide covers big and little endian, how xxd and hexdump render byte order differently, and why XFS superblocks are big-endian.

halkynconsulting.co.uk

Investigative Interviewing That Stands Up in a Tribunal The interview is where most workplace investigations are decided - and where most go wrong. Preparation, structure, questioning technique and documentation that survive hostile scrutiny.

Investigative Interviewing That Stands Up in a Tribunal

The interview is where most workplace investigations are decided - and where most go wrong. Preparation, structure, questioning technique and documentation that survive hostile scrutiny.

halkynconsulting.co.uk

Of all the support posts that got the least traction, a prominent ADHD and Trauma expert saying "help Fluff" Was not on my bingo card. But then disabled sex worker off-hand misgendering dismissively was also not on my bingo card. S'cool I hate me being alive too.

Dr. Amy, PsyD@dramypsyd.rmh-therapy.com · 5d ago

Am I connected to anyone who can help?

Am I connected to anyone who can help?

Pantechnicon@tamaonsuomi.bsky.social · 5d ago

Hi Cloud folk, This is what I had to write today. If you are in the EU and possibly have a spare bit of floor or cupboard or shed I'd be eternally grateful for a few days not in the incoherent stress of a hostel that does not want me to stay I am tired Just a moments safety on the way back pls

Linux investigation tip: a filename identifies a directory entry, not the file object itself. Record both device and inode with `stat -c '%d:%i %n' -- FILE`; inode numbers are unique only within one filesystem.

Binary and Hexadecimal for Security Analysts Hex dumps, memory addresses and file signatures all assume you can read binary and hexadecimal. This practical guide covers both numbering systems from the ground up.

Binary and Hexadecimal for Security Analysts

Hex dumps, memory addresses and file signatures all assume you can read binary and hexadecimal. This practical guide covers both numbering systems from the ground up.

halkynconsulting.co.uk

I have 2 nights left housed. Please help

Memento Mori Povich 🇵🇸❤️‍🔥@paradis3gained.bsky.social · 3w ago

An homeless NB friend in dire need, EF Fluff, was banned by Bsky, I’m sharing their post. EMERGENCY: Seeking donations for a bed in Paris Disabled Human Rights Defender fled Finland & deportation to Irish Police Torture & Sexual Violence www.paypal.com/donate/?host... revolut.me/eff Please share

In my long and extremely online life there are two constants, Zionists and Tankies are the same people, the most anti-cop person you know is an undercover cop.

🤍 forever #caturday 🙃🤭🤣 🤍🤍🤍💛🔆 🎈🔆💛🤍🤍🤍

This 1899 clip of a little girl and her cat is the oldest surviving cat footage on film, just 4 years after the Lumiere brothers invented cinema. Now colorized and speed corrected.

Just think of how sick, twisted and demented you have to be to post this as president knowing it is all a lie because you don’t want to admit you hired an unqualified pool guy - the act of typing this knowing that every word is false.

Hi Cloud folk, This is what I had to write today. If you are in the EU and possibly have a spare bit of floor or cupboard or shed I'd be eternally grateful for a few days not in the incoherent stress of a hostel that does not want me to stay I am tired Just a moments safety on the way back pls

"Atypically resistant to psychosis" is not the super power you might think it is. In fact, it's a bit of a curse, because a bit of incoherent madness wouldn't go amiss right now If only any of you bar @tazwake.bsky.social knew how much I begged and pleaded for peaceful withdrawal. jfc

Pantechnicon@tamaonsuomi.bsky.social · 5d ago

Hi Cloud folk, This is what I had to write today. If you are in the EU and possibly have a spare bit of floor or cupboard or shed I'd be eternally grateful for a few days not in the incoherent stress of a hostel that does not want me to stay I am tired Just a moments safety on the way back pls

An Introduction to Threat Hunting Methodology Threat hunting fails as a vibe and succeeds as a process. An introduction to a practical hunting methodology - scoping the ground, forming hypotheses, hunting endpoints - with Linux-flavoured examples.

An Introduction to Threat Hunting Methodology

Threat hunting fails as a vibe and succeeds as a process. An introduction to a practical hunting methodology - scoping the ground, forming hypotheses, hunting endpoints - with Linux-flavoured examples.

halkynconsulting.co.uk

“Have you checked the copy for the Enterprise display ad?” “Didn’t need to, it’s the same every week” [one day later] “Oh”

I love Glasgow pretty much any time I visit, but I think they've put on wonders for the Commonwealth Games. It has been a blast visiting and definitely makes me want to come back here more often. I hope the city's traders got a big boost from this as well.

Hey Cyber People! If you are interested in IR and want to look at how to investigate Linux intrusions *and* potentially compromised LLMs, then have a look at sans.org/for577. As an added bonus, if you sit this class in the US, you can get a $900 discount if you book before August 15, 2026. #linux

FOR577: LINUX Incident Response and Threat Hunting

Learn to identify, analyze, and respond to attacks on Linux platforms, including AI and LLM threats, and use threat hunting to find stealthy attackers who bypass existing controls.

sans.org

Security Risk Assessment: 7 Steps to Better Decisions Security spending without assessment is guesswork. A practical walk through the seven-step security risk assessment process: assets, loss events, probability, impact, options, feasibility and cost-benefit.

Security Risk Assessment: 7 Steps to Better Decisions

Security spending without assessment is guesswork. A practical walk through the seven-step security risk assessment process: assets, loss events, probability, impact, options, feasibility and cost-benefit.

halkynconsulting.co.uk

Linux Incident Response: A Practical Guide Linux incident response has changed since 2020. This guide covers preparation, live triage, memory capture with AVML, triage collection with UAC and the artefacts that matter most on a compromised Linux host.

Linux Incident Response: A Practical Guide

Linux incident response has changed since 2020. This guide covers preparation, live triage, memory capture with AVML, triage collection with UAC and the artefacts that matter most on a compromised Linux host.

halkynconsulting.co.uk

Linux Memory Management: A High-Level Overview A high-level tour of Linux memory management - virtual memory, paging, the buddy and slab allocators, the page cache, swap and the OOM killer - with pointers on why each matters to security teams and forensic analysts.

Linux Memory Management: A High-Level Overview

A high-level tour of Linux memory management - virtual memory, paging, the buddy and slab allocators, the page cache, swap and the OOM killer - with pointers on why each matters to security teams and forensic analysts.

halkynconsulting.co.uk

Virtual Memory Areas (VMAs): The Linux Equivalent of the Windows VAD Linux has no Virtual Address Descriptor - instead the kernel tracks process memory with Virtual Memory Areas (VMAs). How VMAs work, how they compare to the Windows VAD, and how to inspect them with /proc, pmap and Volatility…

Virtual Memory Areas (VMAs): The Linux Equivalent of the Windows VAD

Linux has no Virtual Address Descriptor - instead the kernel tracks process memory with Virtual Memory Areas (VMAs). How VMAs work, how they compare to the Windows VAD, and how to inspect them with /proc, pmap and Volatility during incident response.

halkynconsulting.co.uk

Workplace Investigations: A Practical Framework Most organisations only discover they need an investigation process after something has gone wrong. A practical framework for scoping, planning and running workplace investigations that survive scrutiny.

Workplace Investigations: A Practical Framework

Most organisations only discover they need an investigation process after something has gone wrong. A practical framework for scoping, planning and running workplace investigations that survive scrutiny.

halkynconsulting.co.uk

NIST SP 800-53 self assessment checklist available for download Our free NIST SP 800-53 self assessment checklist is now available for download. Use it to measure your compliance with the Rev 5 high baseline.

NIST SP 800-53 self assessment checklist available for download

Our free NIST SP 800-53 self assessment checklist is now available for download. Use it to measure your compliance with the Rev 5 high baseline.

halkynconsulting.co.uk

What Assembly Language Is and Why It Matters Assembly language is the human-readable form of the machine code a CPU actually runs. This primer explains how it works and why security professionals benefit from a reading knowledge of it.

What Assembly Language Is and Why It Matters

Assembly language is the human-readable form of the machine code a CPU actually runs. This primer explains how it works and why security professionals benefit from a reading knowledge of it.

halkynconsulting.co.uk

This is interesting. If the attack lasted "days", then this isn't the "overwhelmingly high-speed attack" we've been worried about. It also implies the LLM would fail an OSCP. www.linkedin.com/posts/raphae...

Scoop: The OpenAI agent that broke into tech firm Hugging Face went on a dayslong hacking spree that OpenAI didn't notice until well after the threat was contained and the FBI was alerted, accordi...

Scoop: The OpenAI agent that broke into tech firm Hugging Face went on a dayslong hacking spree that OpenAI didn't notice until well after the threat was contained and the FBI was alerted, according ​...

linkedin.com

Interesting: There’s now an anonymous, moderated list of companies that stop responding after you interviewed with them

Ghosted After a Job Interview? Report the Company

Ghosted after a job interview? Submit an anonymous report and see which companies candidates say stopped responding after interviews.

didtheyghostyou.com

The cyclospora outbreak has reached 7,400 cases across 9 states. The FDA just recalled 1.6 million eggs due to salmonella contamination. Screwworm cases continue to rise. And we’ve just surpassed 2,300 measles cases — breaking 2025’s record. “Make America Healthy Again.”

NIST SP 800-53 Rev 5: What It Is and Why It Pays Off A succinct guide to NIST SP 800-53 Revision 5, what the control catalogue covers, how it is structured, and the commercial and security advantages of aligning with it.

NIST SP 800-53 Rev 5: What It Is and Why It Pays Off

A succinct guide to NIST SP 800-53 Revision 5, what the control catalogue covers, how it is structured, and the commercial and security advantages of aligning with it.

halkynconsulting.co.uk