I've had to analyze several MS Quick Assist compromises and found challenges during each one. Threat Hunting for malicious activity thru QA is not easy either.

So I wrote a blog post on what to look for: https://inversion6.com/resources/blog/january-2025/microsoft-quick-assist-an-it-security-primer

We are aware that there are some members of the digital evidence community who may be wary of, unwilling to, or unable to give evidence to the Parliamentary Inquiry into Computer Evidence (https://www.gov.uk/government/news/use-of-computer-evidence-in-court-to-be-interrogated ). To ensure that their views & experiences can be properly represented, we are running a short survey ro capture essential information that we will submit to the Inquiry on behalf of respondents. All information will be anonymised and only used or reproduced with the consent of the contributors.

The survey has been prepared by Angus Marshall with support from Prof. Sarah Morris and Simon Biles, for whose support we are very grateful.

Please do complete the form at https://forms.gle/BwmDytnHT3z8pmCDA . It should only take 10-20 minutes. Or if you prefer to email us: survey@devce.org

strings to the rescue

Don't forget to at least rerun with --encoding=b too

@volexity has published a blog post about BrazenBamboo, the Chinese threat actor behind the LIGHTSPY and DEEPDATA malware families. This blog post details a FortiClient vulnerability used in the DEEPDATA malware, where user VPN credentials are left in plaintext in memory long after a user has authenticated. Read more here: https://www.volexity.com/blog/2024/11/15/brazenbamboo-weaponizes-forticlient-vulnerability-to-steal-vpn-credentials-via-deepdata

Are certifications important? Yes, no, and it depends.

Do certifications make you an expert? No.
Do certifications help with the hiring process? Yes.
Do certifications help you be up to date? It depends.

If work pays for them, go for it.
If you have to pay them yourself, do your research.