<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>forensics &#8211; SCRT Team Blog</title>
	<atom:link href="/tag/forensics/feed/" rel="self" type="application/rss+xml" />
	<link>/</link>
	<description>Orange Cyberdefense Switzerland&#039;s technical blog</description>
	<lastBuildDate>Thu, 26 Mar 2026 09:17:01 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>/wp-content/uploads/2024/10/cropped-favicon-32x32-1-32x32.png</url>
	<title>forensics &#8211; SCRT Team Blog</title>
	<link>/</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Insomni’Hack 2026 &#8211; Golden Payout writeup</title>
		<link>/2026/03/25/insomnihack-2026-the-golden-payout-writeup/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Wed, 25 Mar 2026 23:35:02 +0000</pubDate>
				<category><![CDATA[Analytics]]></category>
		<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=7338</guid>

					<description><![CDATA[The challenge A massive data breach has just hit our corporate network. Highly sensitive documents have been spotted on a prominent Darknet leaking platform. Preliminary network telemetry has flagged suspicious outbound traffic originating from a specific workstation belonging to one of our DBAs. As part of the Rapid Response Investigation Team, you have been assigned &#8230; <a href="/2026/03/25/insomnihack-2026-the-golden-payout-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni’Hack 2026 &#8211; Golden Payout writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni’hack 2025 – GuLosity writeup</title>
		<link>/2025/03/19/insomnihack-2025-gulosity-writeup/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Wed, 19 Mar 2025 20:43:27 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=6964</guid>

					<description><![CDATA[The challenge A malware was provided from a real DFIR case that occurred in January 2024. The final payloads were disarmed here, to allow the analysts to dissect the binary safely until they fully understand the execution chain of a reflective shellcode loader named GuLoader [which initially led to the delivery of Remcos RAT with &#8230; <a href="/2025/03/19/insomnihack-2025-gulosity-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni’hack 2025 – GuLosity writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Les oubliés des forensics: les Local Shared Objects</title>
		<link>/2010/08/15/les-oublies-des-forensics-les-local-shared-objects/</link>
					<comments>/2010/08/15/les-oublies-des-forensics-les-local-shared-objects/#respond</comments>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Sun, 15 Aug 2010 21:29:57 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[forensics]]></category>
		<guid isPermaLink="false">http://blogscrt.wordpress.com/?p=23</guid>

					<description><![CDATA[Dans le cas d&#8217;une analyse forensics, lors de la reconstruction des actions d&#8217;un utilisateur les cookies du navigateur sont l&#8217;un des premiers points à être analysé. Néanmoins, dans un navigateur ce dernier n&#8217;est pas le seul à laisser des traces: le lecteur Flash dispose également d&#8217;un système de cookies. Le lecteur Flash utilise également des &#8230; <a href="/2010/08/15/les-oublies-des-forensics-les-local-shared-objects/" class="more-link">Continue reading <span class="screen-reader-text">Les oubliés des forensics: les Local Shared Objects</span></a>]]></description>
		
					<wfw:commentRss>/2010/08/15/les-oublies-des-forensics-les-local-shared-objects/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
	</channel>
</rss>
