Steve retweeted
#TaskManager and #ProcessExplorer are dead (because they lie). Long live to @SystemInformer (and shame to #Powerpoint)
Replying to @daaximus
A function named "RunTimeSettings::IsJolt" was added to Windows Task Manager recently with a significant amount of warbird encryption/obfuscation for no reason?
Yeah, @Google my primary email created in 2004 and used daily for 22 years is a bot? I'm now locked out of +450 other websites including my bank, work and github which use it for MFA and have to wait several days before a human reviews the appeal?🤔🤢
Steve retweeted
My new blog post 🥳
Improving AFD Socket Visibility for Windows Forensics & Troubleshooting
It discusses the low-level API under Winsock (IOCTLs on \Device\Afd handles) and explores the workings of the new socket inspection feature in System Informer 🔥
huntandhackett.com/blog/impr…
Steve retweeted
Better socket handle visibility coming soon to @SystemInformer 🔥
When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩






