Daily Blog #803: Getting Chat GPT 4o to make fancy powepoints

 

Hello Reader,

Yesterday, when I shared my presentation, I mentioned that while I conducted all the research myself, I used ChatGPT-4o to create all of the slides.

Why? Because I have absolutely no artistic skills—but I did have all the technical knowledge I wanted to communicate. If you’re like me and want your presentations to look like you hired a professional designer, here’s how I made it happen.

---

Step 1: Tell It What You Want

I started by describing the scope of the presentation:

Create a slideshow presentation about Windows Hello forensics complete with graphics 

and text.

It should cover how to perform forensics on the Windows 11 Hello security feature.

Include slides on:

- History of Hello  
- The historical forensic challenge of identifying who is at the keyboard  
- A list of Windows Hello authentication methods  
- Where in the registry to find which authentication methods are enabled  
- What the event logs show for:
    - PIN login  
    - Fingerprint login  
    - Facial scan login  
- Where Windows Hello data is stored  
- How the stored data is protected  
- How the data can be accessed  

Also, include any other slides you think would be interesting.

It responded with a detailed outline of the slide contents—a sort of text storyboard. 

---

Step 2: Ask for the Presentation

So I followed up with: 

Turn this into a PowerPoint presentation with graphics you create for each slide.

This generated text-only slides. So I clarified further:

Yes, I would like all of the above as you find them most useful.

Generate all relevant graphics and insert them into the slides. 

Also give it a cyberpunk theme.

---

Step 3: Let It Build

It generated the first image, and I simply told it:

Finish all the slides and provide me the updated PPT with the graphics added in.

I had to say “continue” a couple of times to get it to finish the entire deck—but that was it! Afterward, I went in and added relevant technical facts, and the presentation was complete.

---

Looking back, I probably could have done it all in one prompt if I had been more specific. Still, I’m incredibly happy with the results—and I didn’t need any design skills to get there.

Read More

Daily Blog #796: Using AI's to help you with EDR searches

 

Hello Reader,

I've been exploring an effective new use case with various AI models: using them to generate queries across different Endpoint Detection and Response (EDR) platforms. Depending on the client, I regularly switch between multiple EDR solutions, including CrowdStrike Falcon, SentinelOne, Carbon Black Cloud, Palo Alto Cortex XDR, and Microsoft Defender. While I typically know exactly what I want to search for, remembering each platform’s specific syntax (and unique tables—thanks, Microsoft!) can be challenging without a handy cheat sheet.

To simplify things, here are straightforward prompts and queries to find a specific hash using ChatGPT 4.5 for various EDR platforms:

1. CrowdStrike Falcon

Prompt:

"Write a query for CrowdStrike Falcon to search all hosts for a specific hash."

Query:

event_simpleName=ProcessRollup2 SHA256HashData="<your_hash_here>"

2. SentinelOne

Prompt:

"Write a query for SentinelOne to search hosts for a specific hash."

Queries:

ProcessHash = "<your_hash_here>"

or

SHA256 = "<sha256_hash_here>"

3. Carbon Black Cloud

Prompt:

"Write a query for Carbon Black Cloud to search all hosts for a specific hash."

Query:

SELECT path, hash.sha256, hash.md5, hash.sha1
FROM file
WHERE hash.sha256 = '<your_sha256_here>'
   OR hash.md5 = '<your_md5_here>'
   OR hash.sha1 = '<your_sha1_here>';

4. Palo Alto Cortex XDR

Prompt:

"Write a query for Palo Alto XDR to find a hash across all hosts."

Query:

dataset = xdr_data
| filter action_file_sha256 = "<your_sha256_hash_here>"

5. Microsoft Defender for Endpoint

Prompt:

"Write a query for Microsoft Defender to search hosts for a specific hash."

Queries:

DeviceFileEvents
| where SHA256 == "<your_sha256_hash_here>"

For processes:

DeviceProcessEvents
| where SHA256 == "<your_sha256_hash_here>"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256

Next time you're stuck recalling the exact syntax but know precisely what you're looking for, just ask your friendly neighborhood AI assistant for a quick reminder!

Also Read: What did Gemini make up part 2

Read More

Daily Blog #795: What did Gemini make up part 2

 

Hello Reader,

In the last post we focused on the made up blog posts Gemini cited. Now let's look at some of the facts it stated in regards to how long these artifacts will exist for. When talking about prefetch files it does well 

"Limited number of files (e.g., 1024 on Win 10/11). Oldest files are deleted on a FIFO (First-In, First-Out) basis."

But when talking about LNK files which have a similar issue (maximum number on a system before deletion) it said:

"Persists until deleted. Timestamps update upon access."

 Another example is the jumplists

"Persists within the user profile. Number of entries/files managed by Windows/apps."

 We know form testing that this maxes out at 2048.

Now, knowing that we've caught two types of errors, would I use AI to help me write up these materials? In short, Yes! Why? Because it's easier for me to review, correct and edit when it got a lot of the other parts right.

Also Read: What did gemini make up?

Read More

Daily Blog #794: What did gemini make up?

 

Hello Reader,

In last week's post I posted a document that Google Gemini 2.5 Pro created regarding Windows 11 execution artifacts. This week I want to break down where Gemini just made stuff up or was incorrect. The point here is you still need to check the AI model's work and know how and when to use it in your own work. 

Today let's start with something simple, the blog links referenced. Here's an example:

https://www.google.com/search?q=https://www.hecfblog.com/2019/05/recentapps-registry-key.html 

So we can see Google Gemini decided to embed a google search for what appears to be a valid blog entry from hecfblog.com. Unfortunately this blog post doesn't actually exist.

 

What Gemini did was make up likely url's for each topic, but it didn't actually search the blog to find the right one. So that's just the first example of a mistake, let's see what else waits for us tomorrow.

Also Read: What did Gemini make up part 2

Read More

Daily Blog #741: AI powered Honeypots

Hello Reader,

I’ve always found honeypots fascinating. There’s something deeply satisfying about reviewing logs of frustrated attackers and uncovering their latest tactics. However, setting up a convincing honeypot has traditionally required a lot of effort—crafting realistic environments, files, and services to appear valuable while ensuring they couldn’t be exploited for real attacks.

AI has changed the game once again. There are now AI-powered honeypots (at least two that I know of) that leverage large language models to simulate entire systems. These models dynamically generate file listings, process lists, file contents, and other system artifacts, making fingerprinting much harder for attackers. I think this is incredibly cool! In fact, I once asked ChatGPT to pretend to be a Linux system—and the results were hilarious!

Here are two AI-powered honeypots worth checking out:

• Splunk AI Honeypot (DECEIVE) – SSH Honeypot

🔗 GitHub: splunk/DECEIVE

• Galah – HTTP Honeypot

🔗 GitHub: 0x4D31/galah

Hope you find these as interesting as I do!

Also Read: USN V4 Data Ranges

Read More

Daily Blog #714: Forensic Lunch 1/10/25 with Ryatt Roesrma talking about fine tuning AI models

The Forensic Lunch is Back! 🍴

Hello Readers,

I'm excited to announce that The Forensic Lunch is back with another episode! This week, we had the privilege of hosting Wyatt Roersma, who shared his insights on training open-source AI models for specialized tasks.

Wyatt has been exploring how to take open-source AI models, like Qwen-2.5, and train them using examples such as YARA rules and targeted prompts to enhance their usefulness for specific applications. In the episode, he walks us through the process step-by-step, empowering you to apply similar techniques to solve your unique challenges.

For instance, I'm currently experimenting with getting AI models to write dfvfs code. While the models are fairly accurate, I believe with a bit of fine-tuning and additional training, they could become even more precise and reliable.

Key Resources from Wyatt's Discussion

Here are some invaluable links to help you dive deeper into the topics discussed in the episode:

• Download Wyatt’s trained models: Hugging Face – vtriple (Wyatt Roersma)
• Rent GPU containers: Vast.ai
• Run open-source models without local hardware: OpenRouter
• Discover and download models: Hugging Face
• Run local models: Ollama
• Train and fine-tune models: LLaMA-Factory GitHub Repository
  • SFT example: Train with LLaMA-3 LoRA SFT
  • DPO example: Train with LLaMA-3 LoRA DPO
  • LoRA example: Train with Qwen2VL LoRA SFT

Watch the Episode

You can catch the full episode below and learn how to start training your own open-source AI models to tackle specialized problems:

Or click the link here:
https://www.youtube.com/live/z6QkYHo97k0

Also Read: Developing an AWS Examination Tool Part 4

Read More

Daily Blog #713: Developing an AWS Examination Tool Part 4

 Hello Reader,

       Development continues! What all did we do today? Well here is the automated commit message the model made for me:

Enhance AWS Enumerator Tool with Lambda and Gateway Resource Support

- Added functionality to enumerate and display AWS Lambda functions, including details such as runtime, memory, timeout, and VPC configuration.
- Implemented scanning for Internet and NAT Gateways, capturing their state, type, and associated VPCs.
- Introduced a new Network Security tab in the GUI for analyzing security configurations across accounts, including security groups and network ACLs.
- Updated README.md to reflect new features and permissions required for Lambda and Gateway resource access.
- Improved error handling and progress tracking during resource scans.

This commit significantly enhances the AWS Enumerator Tool's capabilities for managing and analyzing AWS resources.

Tomorrow is the Forensic Lunch make sure to tune in!

Also Read:

Developing an AWS Examination Tool Part 1

Developing an AWS Examination Tool Part 2

Developing an AWS Examination Tool Part 3

Read More

Daily Blog #711: Developing an AWS Examination Tool Part 2

 

 

---

Hello Reader,

Today, we're making progress on our feature wishlist by tackling several key enhancements:

1. Selecting Credentials: Currently, it defaults to my AWS profile for FOR509.
2. Adding Support for Global Views.
3. Exporting Inventory.

Step 1: Selecting Credentials

We began by addressing the first feature with the following prompt:

"Prior to enumerating the AWS account, provide a GUI pop-up that asks how the user wants to authenticate to AWS. Options should include:

1. Profile in the creds file
2. An API key provided by the user

If the user selects a profile, they should see a dropdown of available profiles in the creds file to choose from. If they opt to provide an API key, the system should offer a checkbox to store the key with the collection for easy reuse."

This resulted in an error when I ran the Python code. You might think, "Aha! Your lazy adventure ends here—time to fix the code yourself!" But not so fast, dear reader. Instead, I highlighted the error and prompted:

"I got this error."

After resolving two more errors using the same prompt, the model managed to fix itself, and I got the GUI functionality I wanted. Now I can either provide a key or choose from any profiles already stored within the AWS CLI.

 

---

Step 2: Progress Bars

Next, I wanted to add a progress bar to keep users informed during the enumeration process. Here's how I tackled it:

1. First Prompt:

   "Add a GUI progress window that updates as the account is enumerated so the user knows what is happening."

   This worked, but I wanted more. Since enumerating each region can take time, I added a secondary prompt:

2. Second Prompt:

   "Add a second progress bar for each region, showing what is being enumerated."

This introduced a new issue—the progress window popped up but displayed no updates. I informed the model:

"The progress window popped up, but there were no updates displayed."

The model refactored the code to enable real-time GUI updates while enumeration was running. Voilà! A neat dual-progress bar system was now functional.

 

---

Step 3: Region Resource Count

To enhance the user experience further, I requested:

"Add a number next to each listed region summarizing how many resources were found in that region."

This worked beautifully, providing a clear overview of resource counts per region.

 

---

Step 4: Exporting Inventory

For the final item on today's list, I wrote a more detailed prompt:

"Create a toolbar option called 'Export.' When selected, it should open a dialog asking the user to save the output in one of three formats: text (as displayed), JSON, or XLSX. After selecting the format, present a window to choose a save location and filename. The default filename should include the AWS Account ID and the current timestamp, keeping it unique with the chosen extension. Then export all regions' data to the selected file."

This feature worked on the very first attempt! The code automatically added pandas and openpyxl packages to support Excel output.

 

---

Step 5: Finishing Touches

To wrap things up, I asked the model to create essential project files:

1. Requirements File:

   "Create a requirements.txt file with all the necessary packages."

2. GitHub README:

   "Create a README file in Markdown syntax that describes the project, how to install it, how to execute it, and includes an Apache 2 license."

Finally, I pushed the project to its new repository using Cursor for direct linking. You can explore it here: AWSExaminer GitHub Repository.

---

Conclusion

This project is shaping into a useful tool for my AWS cases. The best part? I haven’t had to write a single line of code or look up all the APIs I'm using. Rest assured, I’ll be testing thoroughly to catch any quirks the AI might have introduced.

Stay tuned for tomorrow’s update, where we’ll add even more features!

Also Read:

Developing an AWS Examination Tool Part 1

Developing an AWS Examination Tool Part 3

Developing an AWS Examination Tool Part 4

---

Read More