Hello and welcome to the Friday, October 21st, 22 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

Today we have a guest diary by Logan Fluke and Logan writes about how to use prefetch files in forensics

investigations. Great article for those who are not yet that familiar with some of the

details of Windows forensics. Prefax files are meant to serve as a cache file for the operating system, but the real value for forensics is that it tells you what the software was actually run.

And it can't even tell you, for example, some of the files that this software may have opened.

So if you want to start with Windows forensics,

that's the write-up kind of to introduce you to some of the tools that also help you analyze these Brayfetch files. Microsoft this week released an update to Windows 10 that

isn't exactly a security update,

but I think still worth mentioning the update Microsoft released fixes an issue with TLS connections failing.

And apparently this is something that was introduced with the October patches. It looks like some versions of Windows 11 are affected as well,

by this point there is only a fix for Windows 10. If you have the issue and if this fix doesn't

help or you're running Windows 11, then your only other option is to undo the October patch.

And if you're using Microsoft 365's cloud offering, well, auditing your configuration can be a little bit tedious.

So to help SISA now released a tool in the form of PowerShell scripts that will verify

if a configuration complies with the Scuba minimum viable security configuration baseline.

The tool was released to a GitHub. It's called Scuba Gear,

kind of based on that acronym Scuba, which actually stands for secure cloud business applications.

Scuba is a set of baseline configurations developed for the US federal government, but of course others

may find them helpful as well.

And with that, you may also want to take a look at this tool to help you audit against these

baselines.

...