Daily Blog #803: Getting Chat GPT 4o to make fancy powepoints

 

Hello Reader,

Yesterday, when I shared my presentation, I mentioned that while I conducted all the research myself, I used ChatGPT-4o to create all of the slides.

Why? Because I have absolutely no artistic skills—but I did have all the technical knowledge I wanted to communicate. If you’re like me and want your presentations to look like you hired a professional designer, here’s how I made it happen.

---

Step 1: Tell It What You Want

I started by describing the scope of the presentation:

Create a slideshow presentation about Windows Hello forensics complete with graphics 

and text.

It should cover how to perform forensics on the Windows 11 Hello security feature.

Include slides on:

- History of Hello  
- The historical forensic challenge of identifying who is at the keyboard  
- A list of Windows Hello authentication methods  
- Where in the registry to find which authentication methods are enabled  
- What the event logs show for:
    - PIN login  
    - Fingerprint login  
    - Facial scan login  
- Where Windows Hello data is stored  
- How the stored data is protected  
- How the data can be accessed  

Also, include any other slides you think would be interesting.

It responded with a detailed outline of the slide contents—a sort of text storyboard. 

---

Step 2: Ask for the Presentation

So I followed up with: 

Turn this into a PowerPoint presentation with graphics you create for each slide.

This generated text-only slides. So I clarified further:

Yes, I would like all of the above as you find them most useful.

Generate all relevant graphics and insert them into the slides. 

Also give it a cyberpunk theme.

---

Step 3: Let It Build

It generated the first image, and I simply told it:

Finish all the slides and provide me the updated PPT with the graphics added in.

I had to say “continue” a couple of times to get it to finish the entire deck—but that was it! Afterward, I went in and added relevant technical facts, and the presentation was complete.

---

Looking back, I probably could have done it all in one prompt if I had been more specific. Still, I’m incredibly happy with the results—and I didn’t need any design skills to get there.

Read More

Daily Blog #796: Using AI's to help you with EDR searches

 

Hello Reader,

I've been exploring an effective new use case with various AI models: using them to generate queries across different Endpoint Detection and Response (EDR) platforms. Depending on the client, I regularly switch between multiple EDR solutions, including CrowdStrike Falcon, SentinelOne, Carbon Black Cloud, Palo Alto Cortex XDR, and Microsoft Defender. While I typically know exactly what I want to search for, remembering each platform’s specific syntax (and unique tables—thanks, Microsoft!) can be challenging without a handy cheat sheet.

To simplify things, here are straightforward prompts and queries to find a specific hash using ChatGPT 4.5 for various EDR platforms:

1. CrowdStrike Falcon

Prompt:

"Write a query for CrowdStrike Falcon to search all hosts for a specific hash."

Query:

event_simpleName=ProcessRollup2 SHA256HashData="<your_hash_here>"

2. SentinelOne

Prompt:

"Write a query for SentinelOne to search hosts for a specific hash."

Queries:

ProcessHash = "<your_hash_here>"

or

SHA256 = "<sha256_hash_here>"

3. Carbon Black Cloud

Prompt:

"Write a query for Carbon Black Cloud to search all hosts for a specific hash."

Query:

SELECT path, hash.sha256, hash.md5, hash.sha1
FROM file
WHERE hash.sha256 = '<your_sha256_here>'
   OR hash.md5 = '<your_md5_here>'
   OR hash.sha1 = '<your_sha1_here>';

4. Palo Alto Cortex XDR

Prompt:

"Write a query for Palo Alto XDR to find a hash across all hosts."

Query:

dataset = xdr_data
| filter action_file_sha256 = "<your_sha256_hash_here>"

5. Microsoft Defender for Endpoint

Prompt:

"Write a query for Microsoft Defender to search hosts for a specific hash."

Queries:

DeviceFileEvents
| where SHA256 == "<your_sha256_hash_here>"

For processes:

DeviceProcessEvents
| where SHA256 == "<your_sha256_hash_here>"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256

Next time you're stuck recalling the exact syntax but know precisely what you're looking for, just ask your friendly neighborhood AI assistant for a quick reminder!

Also Read: What did Gemini make up part 2

Read More

Daily Blog #795: What did Gemini make up part 2

 

Hello Reader,

In the last post we focused on the made up blog posts Gemini cited. Now let's look at some of the facts it stated in regards to how long these artifacts will exist for. When talking about prefetch files it does well 

"Limited number of files (e.g., 1024 on Win 10/11). Oldest files are deleted on a FIFO (First-In, First-Out) basis."

But when talking about LNK files which have a similar issue (maximum number on a system before deletion) it said:

"Persists until deleted. Timestamps update upon access."

 Another example is the jumplists

"Persists within the user profile. Number of entries/files managed by Windows/apps."

 We know form testing that this maxes out at 2048.

Now, knowing that we've caught two types of errors, would I use AI to help me write up these materials? In short, Yes! Why? Because it's easier for me to review, correct and edit when it got a lot of the other parts right.

Also Read: What did gemini make up?

Read More

Daily Blog #794: What did gemini make up?

 

Hello Reader,

In last week's post I posted a document that Google Gemini 2.5 Pro created regarding Windows 11 execution artifacts. This week I want to break down where Gemini just made stuff up or was incorrect. The point here is you still need to check the AI model's work and know how and when to use it in your own work. 

Today let's start with something simple, the blog links referenced. Here's an example:

https://www.google.com/search?q=https://www.hecfblog.com/2019/05/recentapps-registry-key.html 

So we can see Google Gemini decided to embed a google search for what appears to be a valid blog entry from hecfblog.com. Unfortunately this blog post doesn't actually exist.

 

What Gemini did was make up likely url's for each topic, but it didn't actually search the blog to find the right one. So that's just the first example of a mistake, let's see what else waits for us tomorrow.

Also Read: What did Gemini make up part 2

Read More

Daily Blog #741: AI powered Honeypots

Hello Reader,

I’ve always found honeypots fascinating. There’s something deeply satisfying about reviewing logs of frustrated attackers and uncovering their latest tactics. However, setting up a convincing honeypot has traditionally required a lot of effort—crafting realistic environments, files, and services to appear valuable while ensuring they couldn’t be exploited for real attacks.

AI has changed the game once again. There are now AI-powered honeypots (at least two that I know of) that leverage large language models to simulate entire systems. These models dynamically generate file listings, process lists, file contents, and other system artifacts, making fingerprinting much harder for attackers. I think this is incredibly cool! In fact, I once asked ChatGPT to pretend to be a Linux system—and the results were hilarious!

Here are two AI-powered honeypots worth checking out:

• Splunk AI Honeypot (DECEIVE) – SSH Honeypot

🔗 GitHub: splunk/DECEIVE

• Galah – HTTP Honeypot

🔗 GitHub: 0x4D31/galah

Hope you find these as interesting as I do!

Also Read: USN V4 Data Ranges

Read More

Daily Blog #714: Forensic Lunch 1/10/25 with Ryatt Roesrma talking about fine tuning AI models

The Forensic Lunch is Back! 🍴

Hello Readers,

I'm excited to announce that The Forensic Lunch is back with another episode! This week, we had the privilege of hosting Wyatt Roersma, who shared his insights on training open-source AI models for specialized tasks.

Wyatt has been exploring how to take open-source AI models, like Qwen-2.5, and train them using examples such as YARA rules and targeted prompts to enhance their usefulness for specific applications. In the episode, he walks us through the process step-by-step, empowering you to apply similar techniques to solve your unique challenges.

For instance, I'm currently experimenting with getting AI models to write dfvfs code. While the models are fairly accurate, I believe with a bit of fine-tuning and additional training, they could become even more precise and reliable.

Key Resources from Wyatt's Discussion

Here are some invaluable links to help you dive deeper into the topics discussed in the episode:

• Download Wyatt’s trained models: Hugging Face – vtriple (Wyatt Roersma)
• Rent GPU containers: Vast.ai
• Run open-source models without local hardware: OpenRouter
• Discover and download models: Hugging Face
• Run local models: Ollama
• Train and fine-tune models: LLaMA-Factory GitHub Repository
  • SFT example: Train with LLaMA-3 LoRA SFT
  • DPO example: Train with LLaMA-3 LoRA DPO
  • LoRA example: Train with Qwen2VL LoRA SFT

Watch the Episode

You can catch the full episode below and learn how to start training your own open-source AI models to tackle specialized problems:

Or click the link here:
https://www.youtube.com/live/z6QkYHo97k0

Also Read: Developing an AWS Examination Tool Part 4

Read More

Daily Blog #713: Developing an AWS Examination Tool Part 4

 Hello Reader,

       Development continues! What all did we do today? Well here is the automated commit message the model made for me:

Enhance AWS Enumerator Tool with Lambda and Gateway Resource Support

- Added functionality to enumerate and display AWS Lambda functions, including details such as runtime, memory, timeout, and VPC configuration.
- Implemented scanning for Internet and NAT Gateways, capturing their state, type, and associated VPCs.
- Introduced a new Network Security tab in the GUI for analyzing security configurations across accounts, including security groups and network ACLs.
- Updated README.md to reflect new features and permissions required for Lambda and Gateway resource access.
- Improved error handling and progress tracking during resource scans.

This commit significantly enhances the AWS Enumerator Tool's capabilities for managing and analyzing AWS resources.

Tomorrow is the Forensic Lunch make sure to tune in!

Also Read:

Developing an AWS Examination Tool Part 1

Developing an AWS Examination Tool Part 2

Developing an AWS Examination Tool Part 3

Read More

Daily Blog #711: Developing an AWS Examination Tool Part 2

 

 

---

Hello Reader,

Today, we're making progress on our feature wishlist by tackling several key enhancements:

1. Selecting Credentials: Currently, it defaults to my AWS profile for FOR509.
2. Adding Support for Global Views.
3. Exporting Inventory.

Step 1: Selecting Credentials

We began by addressing the first feature with the following prompt:

"Prior to enumerating the AWS account, provide a GUI pop-up that asks how the user wants to authenticate to AWS. Options should include:

1. Profile in the creds file
2. An API key provided by the user

If the user selects a profile, they should see a dropdown of available profiles in the creds file to choose from. If they opt to provide an API key, the system should offer a checkbox to store the key with the collection for easy reuse."

This resulted in an error when I ran the Python code. You might think, "Aha! Your lazy adventure ends here—time to fix the code yourself!" But not so fast, dear reader. Instead, I highlighted the error and prompted:

"I got this error."

After resolving two more errors using the same prompt, the model managed to fix itself, and I got the GUI functionality I wanted. Now I can either provide a key or choose from any profiles already stored within the AWS CLI.

 

---

Step 2: Progress Bars

Next, I wanted to add a progress bar to keep users informed during the enumeration process. Here's how I tackled it:

1. First Prompt:

   "Add a GUI progress window that updates as the account is enumerated so the user knows what is happening."

   This worked, but I wanted more. Since enumerating each region can take time, I added a secondary prompt:

2. Second Prompt:

   "Add a second progress bar for each region, showing what is being enumerated."

This introduced a new issue—the progress window popped up but displayed no updates. I informed the model:

"The progress window popped up, but there were no updates displayed."

The model refactored the code to enable real-time GUI updates while enumeration was running. Voilà! A neat dual-progress bar system was now functional.

 

---

Step 3: Region Resource Count

To enhance the user experience further, I requested:

"Add a number next to each listed region summarizing how many resources were found in that region."

This worked beautifully, providing a clear overview of resource counts per region.

 

---

Step 4: Exporting Inventory

For the final item on today's list, I wrote a more detailed prompt:

"Create a toolbar option called 'Export.' When selected, it should open a dialog asking the user to save the output in one of three formats: text (as displayed), JSON, or XLSX. After selecting the format, present a window to choose a save location and filename. The default filename should include the AWS Account ID and the current timestamp, keeping it unique with the chosen extension. Then export all regions' data to the selected file."

This feature worked on the very first attempt! The code automatically added pandas and openpyxl packages to support Excel output.

 

---

Step 5: Finishing Touches

To wrap things up, I asked the model to create essential project files:

1. Requirements File:

   "Create a requirements.txt file with all the necessary packages."

2. GitHub README:

   "Create a README file in Markdown syntax that describes the project, how to install it, how to execute it, and includes an Apache 2 license."

Finally, I pushed the project to its new repository using Cursor for direct linking. You can explore it here: AWSExaminer GitHub Repository.

---

Conclusion

This project is shaping into a useful tool for my AWS cases. The best part? I haven’t had to write a single line of code or look up all the APIs I'm using. Rest assured, I’ll be testing thoroughly to catch any quirks the AI might have introduced.

Stay tuned for tomorrow’s update, where we’ll add even more features!

Also Read:

Developing an AWS Examination Tool Part 1

Developing an AWS Examination Tool Part 3

Developing an AWS Examination Tool Part 4

---

Read More

Daily Blog #706: Using AI to help create better test evidence

 

 

Hello Reader,

Two AI-related posts in a row might seem like a lot, but I’ve been incorporating AI into my research for the past couple of years, so it naturally comes up in my work. While I’m not quite ready to share what I’ve been doing recently with Cursor, an AI IDE, I do want to showcase how I’ve used AI to create better datasets for forensic testing.

Creating engaging datasets for others to learn from can be a challenge, particularly when it comes to adding interesting elements for people to discover. In the past, I relied on downloading random free ebooks or generating large files with random data. However, I wondered if AI could improve this process. So, I tried this prompt:

“Create a PowerShell script that will generate a series of files with names related to AI technologies and themed around projects called ‘AI Tacos’ and ‘AI Burritos.’ The script should create 100 files with random data to vary their sizes. The files should use popular extensions and avoid numbers in the names. Instead, include at least 30 unique terms commonly used in research and development.”

The AI-generated script worked perfectly. When executed, it created 100 files in my specified directory, each with randomized content and varied file extensions. The result, as shown in the screenshot below, added depth and realism to my sample datasets.

 

This kind of themed, random data is incredibly useful for making datasets feel more authentic. For example, I can create a new virtual hard drive (VHD), populate it with these files, and then focus on generating interactions that leave digital artifacts for forensic analysis.

If you’re looking to populate other types of content, AI can help there too. For instance, this prompt:

“Write 5 text messages between two friends named David Cowen and Matthew Seyer discussing what kind of tacos to have for lunch.”

Produced the following conversation:

David Cowen: Hey Matt, I'm thinking tacos for lunch today. You up for it?
Matthew Seyer: Absolutely, dude! I could eat tacos every day. Any idea what kind?
David Cowen: I'm torn between fish tacos and something spicy, like chipotle chicken. What do you think?
Matthew Seyer: Fish tacos would be great, but I’m kind of craving some good old barbacoa. How about we do both?
David Cowen: Perfect idea! Let’s split an order of each so we can try everything. I’ll meet you in 20.

I even took it a step further and used AI to craft detailed fictional personas. For example, I used this prompt:

“Create a background story for a fictional employee at a company called TacoCorp who has worked there for 10 years as an IT administrator. This person has been recruited by BurritoTown to steal secrets from TacoCorp. Provide motivations, names, and profiles for their boss, coworker, new boss at BurritoTown, and best friend who’s a local police officer. Include a CV, LinkedIn bio, and 10 social media posts detailing their life.”

The AI generated a detailed persona, including:

• Name: Oliver Delgado
• Email: [email protected]
• Social Media Handle: @OllieTacoTech

Motivations for Betrayal:
Oliver felt undervalued and underpaid after a decade at TacoCorp. Financial pressure and resentment toward his boss pushed him to accept BurritoTown’s lucrative offer to steal TacoCorp’s secrets.

Supporting Characters:

• Franklin Hoyt, a strict and demanding boss at TacoCorp.
• Samantha Mills, a friendly coworker unaware of Oliver’s frustrations.
• Grace Li, the ambitious new boss at BurritoTown.
• Daniel Morales, Oliver’s loyal best friend and a local detective.

The AI even provided Oliver’s CV, LinkedIn bio, social media posts, and a detailed headshot description for his persona.

This ability to quickly generate characters, scenarios, and realistic data allows me to focus on ensuring the technical accuracy of my work. AI tools are invaluable for filling in creative gaps and enhancing the realism of forensic datasets. Don’t underestimate how much they can help!

Also Read:  AI Prompts that help me

Read More