BJJ Blackbelt, Memory 4N6 nerd, malwareRE noob, poorly rated chess player.
Joined May 2014
- Tweets2.3K
- Following888
- Followers1.2K
- Likes5K
Aaron Sparling retweeted
📣 New keynote just announced for next week’s #DFIRSummit!
What does a forensic investigation look like when the AI system itself is the victim and there’s no disk image to examine? Raymond DePalma joins us in Arlington to take on that question.
➡️ go.sans.org/TSSBBf
ALT Here is an alternate text description: A promotional image for the Digital Forensics & Incident Response Summit & Training 2026 by SANS. It features a keynote titled "The AI System Was the Victim: Forensics for a Crime Scene with No Disk Image" by Raymond DePalma, President of DePalma Research LLC. The event is scheduled for October 15-16 in Arlington, VA and online, with training from October 17-22. A small picture of an individual is also included.
Aaron Sparling retweeted
Two examiners. Two high-profile cases. One stage.
At #SANSDFIR Summit, @HeatherMahalik and Jason Higley deliver back-to-back keynotes, then unpack the forensic tradecraft behind the cases, exclusively in person.
📍 Arlington, VA | Oct. 15–16
go.sans.org/i2cTqC
Aaron Sparling retweeted
There’s still time to join us at #DFIRSummit.
Why attend? Because this is where all of DFIR comes together in one event.
🔎 Digital Forensics
🚨 Incident Response
🎯 Threat Hunting
🧠 CTI
🔬 Malware Analysis
🤖 AI in DFIR
🔐 Ransomware
All of DFIR. One Event.
Don't miss it!
1 Summit. 3 focus areas: #DFIR, #ThreatHunting & #Ransomware.
@HeatherMahalik shares why #SANSDFIR belongs on your calendar. Join us in Arlington for exclusive keynotes, hands-on workshops & community, or watch select talks online.
🗓️ Oct. 15–16
go.sans.org/i2cTqC
Aaron Sparling retweeted
⏰ Two weeks from today, the DFIR community comes together in Arlington for #DFIRSummit.
Join @ovie, @maridegrazia & @rj_chap Oct. 15–16 for keynotes, talks & hands-on workshops covering DFIR, Ransomware & Threat Hunting.
➡️ Learn More & Save Your Spot: go.sans.org/TSSBBf
Aaron Sparling retweeted
2 examiners. 2 high-profile cases. 1 stage.
At #SANSDFIR Summit, Heather Barnhart and Jason Higley deliver back-to-back keynotes, then unpack the forensic tradecraft behind the cases, exclusively in person.
📍 Arlington, VA | Oct. 15–16
Register here: go.sans.org/i2cTqC
Aaron Sparling retweeted
Quick post about a stealer masquerading as DocuSign shared by @malwrhunterteam: 6d979466596978ffcb633a0b8c47adedd0778555c0e513fc3d3c84bcef6f036b (macho - 6 VT hits) and uses simple XOR for strings.
🧵
Aaron Sparling retweeted
Security leaders are often trapped in endless assessments and opinion-giving without driving actual change. Staying busy with spreadsheets, dashboards, and emails doesn't move the organization forward.
Here's how we can break out of the "Chief Opinion Officer" mode: zeltser.com/chief-opinion-of…
Aaron Sparling retweeted
REMnux v8 brings AI integration to the Linux malware analysis toolkit, by @helpnetsecurity:
helpnetsecurity.com/2026/02/…
Aaron Sparling retweeted
Added Malcat Lite (@malcat4ever) to REMnux for analyzing binary files using a hex editor, disassembler, and file dissector: malcat.fr
Aaron Sparling retweeted
My new site for learning macOS malware reverse engineering:
l0psec.github.io/Malware_RE_…
I got my start in RE by using @patrickwardle's awesome blog. I would download samples and follow along. So I created this to complement that with dives into specific code from recent samples.
Aaron Sparling retweeted
We're looking for a Principal Threat Intel Incident Commander here at @HuntressLabs ! Do you love to:
🔍 Conduct #DFIR analysis?
👀 Track threat actors?
🕸️ Work with others across different departments?
✍️ Write about your findings?
👩💼 Present your work?
👇
Aaron Sparling retweeted
I'm happy to announce this new release.
REMnux based on Ubuntu 24.04 (Noble) is available now, along with a new, more resilient installer. Available as prebuilt VMs for VMware, Proxmox and VirtualBox, as well as a Docker container. Get your malware analysis toolkit from REMnux.org.
Aaron Sparling retweeted
.@volatility New Release: #volatility3 v2.27.0 - visit github.com/volatilityfoundat… for details and downloads.
#memoryforensics #dfir
Aaron Sparling retweeted
the recording of my talk on the Black Hat show floor is up on yout00b :) youtu.be/whhOYRWd_rs
Aaron Sparling retweeted
For those who missed it, our founder Joshua Reynolds featured the Binja Lattice MCP server on Prompt||GTFO here: youtube.com/watch?v=tNd_j0iG… where he highlighted reverse engineering malware with AI!
Aaron Sparling retweeted
Just posted my @defcon slides (talk #2): "Binary Facades"
Mac malware may be compiled Mach-Os but can contain embedded scripts. Learn to spot these 'faux' binaries + the techniques to extract their scripts ...skipping the disassembler entirely! 🍎🐛
speakerdeck.com/patrickwardl…
Aaron Sparling retweeted
Now at #DFIRSummit: Aaron Sparling @OSINTlabworks @Walmarttech walks through forensic techniques for analyzing #TAILs—an OS built for anonymity. From RAM imaging to artifact recovery, this session tackles how to investigate what’s designed to disappear. #MemoryForensics #DFIR
Aaron Sparling retweeted
We are excited to announce FTSCon 2025 on October 20, 2025, in Arlington VA! Registration is now OPEN + we have a Call for Speakers.
Following FTSCon will be a 4-day Malware & Memory Forensics Training course with Volatility 3.
See the full details here: volatilityfoundation.org/ann…
Aaron Sparling retweeted
We are very excited to announce that Volatility 3 has reached parity with Volatility 2! With this achievement, Volatility 2 is now deprecated. See the full details in our blog post: volatilityfoundation.org/ann…
