--- title: "#dfir articles | Hashnode" description: "Explore 71 articles tagged #dfir on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/dfir" --- Tag # #dfir 71 posts · 8 followers [victor nkereuwem](https://hashnode.com/@iameskor) · [Oct 18](https://hashnode.com/posts/port-security-rules/6ad5469b00c8fb052c509de5) ### [Port Security Rules](https://iameskor.hashnode.dev/port-security-rules?utm_source=hashnode&utm_medium=feed) Master core network port exposure rules (SSH, SMB, RDP, MySQL) and reconstruct Windows attack narratives using SHA-256, Event IDs, and Prefetch. 2 min read · [iameskor.hashnode.dev](https://iameskor.hashnode.dev/port-security-rules?utm_source=hashnode&utm_medium=feed) [rathsara](https://hashnode.com/@rathsara) · [Sep 21](https://hashnode.com/posts/network-data-hiding-covert-channels-and-traffic-manipulation/6ab1388b156512979e6ce8cc) ### [Network Data Hiding: Covert Channels and Traffic Manipulation](https://rr-cyber.hashnode.dev/network-data-hiding-covert-channels-and-traffic-manipulation?utm_source=hashnode&utm_medium=feed) From IP headers to DNS queries: how covert channels work and how their traffic patterns give them away 17 min read · [rr-cyber.hashnode.dev](https://rr-cyber.hashnode.dev/network-data-hiding-covert-channels-and-traffic-manipulation?utm_source=hashnode&utm_medium=feed) [rathsara](https://hashnode.com/@rathsara) · [Sep 18](https://hashnode.com/posts/windows-where-data-hides-and-how-it-s-found/6aacff122422f9edf7f68ba3) ### [Windows: Where Data Hides and How It's Found](https://rr-cyber.hashnode.dev/windows-where-data-hides-and-how-it-s-found?utm_source=hashnode&utm_medium=feed) A file reports 25 bytes. A different command reveals 19MB attached to it. Where NTFS actually hides data, and the exact commands that find it. 15 min read · [rr-cyber.hashnode.dev](https://rr-cyber.hashnode.dev/windows-where-data-hides-and-how-it-s-found?utm_source=hashnode&utm_medium=feed) [rathsara](https://hashnode.com/@rathsara) · [Sep 18](https://hashnode.com/posts/gnu-linux-where-data-hides-and-how-it-s-found/6aad21f08c2d1a534bbb2d82) ### [GNU/Linux: Where Data Hides and How It's Found](https://rr-cyber.hashnode.dev/gnu-linux-where-data-hides-and-how-it-s-found?utm_source=hashnode&utm_medium=feed) A partition table entry reading "Hidden FAT16." An inode field nobody writes to. A nanosecond timestamp carrying encoded data. Where GNU/Linux hides evidence and how investigators find it. 13 min read · [rr-cyber.hashnode.dev](https://rr-cyber.hashnode.dev/gnu-linux-where-data-hides-and-how-it-s-found?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 9](https://hashnode.com/posts/response-and-recovery-tryhackme/6aa1550f1d1b97b41b31bee7) ### [Response and Recovery (TryHackMe)](https://www.sharonjebitok.com/response-and-recovery-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the challenge on TryHackMe: Response and Recovery Introduction Response and Recovery picks up where Detection and Analysis left off: the investigation into the compromised l.chen@nexusfinancia 2 min read · [sharonjebitok.com](https://www.sharonjebitok.com/response-and-recovery-tryhackme?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 9](https://hashnode.com/posts/post-incident-activity-tryhackme/6aa156b4a21c100ff7808910) ### [Post-Incident Activity (TryHackMe)](https://www.sharonjebitok.com/post-incident-activity-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the challenge on TryHackMe: Post-Incident Activity Introduction Post-Incident Activity closes out the Nexus Financial BEC investigation series, shifting from "what happened during the incident 2 min read · [sharonjebitok.com](https://www.sharonjebitok.com/post-incident-activity-tryhackme?utm_source=hashnode&utm_medium=feed) [rathsara](https://hashnode.com/@rathsara) · [Sep 3](https://hashnode.com/posts/windows-memory-forensics-finding-a-live-infection-with-volatility/6a99844241215cf6805a0d0a) ### [Windows Memory Forensics: Finding a Live Infection with Volatility](https://rr-cyber.hashnode.dev/windows-memory-forensics-finding-a-live-infection-with-volatility?utm_source=hashnode&utm_medium=feed) Tracing a live Windows infection through volatile memory, from a suspicious process to injected code, persistence, and attacker intent. 11 min read · [rr-cyber.hashnode.dev](https://rr-cyber.hashnode.dev/windows-memory-forensics-finding-a-live-infection-with-volatility?utm_source=hashnode&utm_medium=feed) [rathsara](https://hashnode.com/@rathsara) · [Sep 3](https://hashnode.com/posts/gnu-linux-memory-forensics-is-the-compromise-still-live/6a998685fb0a56e436fbbb63) ### [GNU/Linux Memory Forensics: Is the Compromise Still Live?](https://rr-cyber.hashnode.dev/gnu-linux-memory-forensics-is-the-compromise-still-live?utm_source=hashnode&utm_medium=feed) Following the evidence in memory to determine what survived after an attack 9 min read · [rr-cyber.hashnode.dev](https://rr-cyber.hashnode.dev/gnu-linux-memory-forensics-is-the-compromise-still-live?utm_source=hashnode&utm_medium=feed) [Magesh](https://hashnode.com/@0xog) · [Aug 24](https://hashnode.com/posts/apiwizards-breach-tryhackme-walkthrough/6a8c64afa6bd16d5dae46a3d) ### [APIWizards Breach-Tryhackme Walkthrough](https://0xog.hashnode.dev/apiwizards-breach-tryhackme-walkthrough?utm_source=hashnode&utm_medium=feed) Investigate a security breach at APIWizards Inc. 6 min read · [0xog.hashnode.dev](https://0xog.hashnode.dev/apiwizards-breach-tryhackme-walkthrough?utm_source=hashnode&utm_medium=feed) [rathsara](https://hashnode.com/@rathsara) · [Aug 15](https://hashnode.com/posts/what-we-got-from-cloud-security-platform-to-operational-capability/6a8045e717f39e1d21f4f263) ### [What We Got: From Cloud Security Platform to Operational Capability](https://rr-cyber.hashnode.dev/what-we-got-from-cloud-security-platform-to-operational-capability?utm_source=hashnode&utm_medium=feed) This is the fifth and final article in a series on deploying Prisma Cloud across a multi-cloud enterprise estate. It covers what the programme actually delivered a few months into steady-state operation: the metrics that mattered, what the platform caught that we would otherwise have missed, and the closing lesson the whole series has been building toward. 10 min read · [rr-cyber.hashnode.dev](https://rr-cyber.hashnode.dev/what-we-got-from-cloud-security-platform-to-operational-capability?utm_source=hashnode&utm_medium=feed)