A round-up of today’s digital forensics news and views:
Forensic Focus News
Investigating WMI Permanent Event Subscription Persistence
Permanent WMI subscriptions are a stealthy Windows persistence technique requiring no autorun entries, services, or scheduled tasks. Independent DFIR researcher Vitalii Kukhol walks through detecting ActiveScriptEventConsumer-based persistence using Sysmon events 19, 20, and 21, WMI-Activity logs, PowerShell script block logging, and memory forensics with Volatility 3. Key artifacts include scrcons.exe process creation timing, corroborating WMI-Activity Event ID 5857, and the resulting file dropped on the desktop.
Atola TaskForce Gets A Massive Update Including A New Compare Module
Atola Technology’s firmware version 2026.10 for TaskForce and TaskForce 2 forensic imagers introduces a new Compare module for sector-by-sector comparison of source drives and their images, flagging differences or unreadable sectors. Diagnostics now detect used Seagate drives fraudulently reset to appear new, using FARM log analysis against SMART values. New and expanded web API endpoints support automation workflows, with three additional endpoints planned for future releases.
Case Studies
Ephemeral Supply Chain Attack Exploits Updater Triage
Google Threat Intelligence Group and Mandiant documented a campaign targeting AOMEI Backupper that briefly swapped update config files on the vendor’s own servers, redirecting clients to a malicious ZIP before restoring clean files, with confirmed exposure windows as short as five minutes. Artifacts to hunt include scheduled tasks RadminComponentRuntime and NitroRuntime, a signed Radmin FamItrfc.exe running alongside unsigned BlkScrDl.dll, and the User-Agent string Anyviewer-loader/1.0 in proxy logs. One attack variant used an invisible 1×1 popup to harvest NTLM hashes via outbound WebDAV.
Tools & Software
Firefox 147 Path Change Breaks Linux Forensic Tools
Firefox 147 adopted the XDG Base Directory Specification, moving browser profile data from ~/.mozilla/firefox to ~/.config/mozilla/firefox on Linux systems, silently invalidating assumptions baked into several DFIR tools. UAC and SQLiteHunter both missed the new path, prompting fixes now under review or merged. DetectRaptor and SQLiteHunter have been expanded to cover traditional, Snap, and Flatpak browser packaging across Firefox and Chromium-based browsers.
Open-Source Tool Extracts WhatsApp Web Browser Data
WhatsApp Web Extractor is a new open-source forensic tool that parses Chrome, Edge, Brave, and Firefox browser profiles to recover WhatsApp Web chats, media, and metadata without launching a browser. It reads IndexedDB and localStorage directly, supports three decryption modes, and outputs both readable JSON and an Android-format msgstore.db compatible with existing WhatsApp forensic suites. A GUI and CLI are available for Windows, with a Linux binary also provided.
CapLoader 2.2 Adds Network Abuse Alerts
NETRESEC has released CapLoader 2.2, adding built-in detections for commonly abused infrastructure including IPFS gateways, port-forwarding services, bulletproof ASNs, and VPN protocols, with external blocklist support from IFIN, GAYINT, and Spamhaus. Alert-based row coloring now highlights flows, services, and hosts by highest severity, and JA4 fingerprinting is corrected for TLS Signature Algorithms containing GREASE values.
Industry News
ConnectWise Credential Breach Exposes M365 Audit Gaps
A stolen ConnectWise Cloud Backup credential was used on October 15 to harvest Microsoft Graph tokens across more than 170 customer tenants, with one compromised app self-elevating to Global Administrator within minutes. App-only actions in Entra leave no source IP in audit logs, and Graph directory reads are not logged at all, meaning a clean log cannot confirm that data was not accessed. Responders should audit service principal sign-ins, hunt for apps that modified their own role assignments, and inventory credentials on all enterprise app registrations for additions since October 13.
Research & Techniques
Event ID Searches Alone Insufficient for IR
Searching Windows Event Logs by event ID alone is unreliable, as IDs are not unique across sources and Microsoft itself reuses them across providers. Effective Windows incident response requires normalizing multiple data sources, including WEVTX, file system, and EDR telemetry, into a timeline for contextual analysis. Investigators who rely on narrow, single-source approaches risk missing gaps, particularly as AI tools trained on incomplete methodology increasingly shape analyst practice.
Read more (windowsir.blogspot.com)
Training & Events
Drone Forensics Training Digs Into DJI Hex Data
Spyder Forensics has updated its drone forensics curriculum to cover hex-level analysis of DJI DAT flight log files, moving examiners beyond automated tool output. Students work directly with raw binary structures using CyberChef and hex editors to manually verify decoded values and understand how forensic tools extract flight data. The course emphasises that practitioners should be able to explain and defend findings based on underlying data, not solely on tool-generated reports.
