Once in a while, I’ll stumble on a question online (or get an email) from a person wondering “Who the heck is leeholm16?”

If you’re reading this post, you’re likely one of them :)

I never know exactly what situation leads people to ask the question, but they’ve invariably started using a forensic parsing tool against Windows PowerShell.lnk or Windows PowerShell (x86).lnk. For example, here is the forensic analysis of the LNK file included in a SANS408 course. It comes from lp.exe by TZWorks.

If you’re looking to play with the cool Desktop Mode on your shiny new Steam Deck, you might have already seen that it is Arch Linux under the hood. Time to get your favourite shell on there :)

Here’s how to get PowerShell running using the community-contributed PowerShell binaries in the Arch User Repository!

Watchy is an exciting Open Source E-Paper Watch, based on Arduino and the ESP32 micro controller.

I’ve been a fortunate early backer, and doubly fortunate to have been part of some of the early waves that already have their physical Watchy. The component shortage has impacted the whole industry, and SQFMI is no different. However, the great news is that supply has opened up and SQFMI is currently in the process of shipping another huge wave of orders with more to come next month.

20 years ago, I decided to put up a “Web Log” - or “blog” for short :)

I didn’t know what would become of it, but I’m happy that I started. In the years since, this site has seen a ton of change:

I am extremely excited to announce that the 4th edition of the PowerShell Cookbook is now available!

Now in its 4th edition, the PowerShell Cookbook is now available from Amazon and other major retailers.

The 1st edition of the PowerShell Cookbook came out in 2007 - nearly 14 years ago! It had the single goal of making you immediately effective with PowerShell. While the Cookbook of course dives deep into all PowerShell’s most important cmdlets and language features, it teaches you in the context of accomplishing real-world tasks. And along the way, it also includes pre-baked scripts to solve major scenarios that PowerShell doesn’t quite solve out of the box.

It’s alive!

Now in its 3rd edition, the PowerShell Pocket Reference is now available from Amazon and other major retailers.

The Pocket Reference series, excerpted from the references of the PowerShell Cookbook, puts concise summaries of all of the information you need about PowerShell on a day-to-day basis right at your fingertips. Want to refresh your memory about how to write a zero-width negative lookbehind assertion in a PowerShell regular expression? No problem - just check out the chapter on Regular Expressions. Need to remind yourself on how to define a method in a PowerShell class? That’s there too.

A class of security research out there that is a never-ending source of entertainment is “novel” communication methods. This shows up in many ways in the security industry, including:

• “Novel” C2 communication channels (DropBox, Telegram, DNS, Instagram comments, …)
• “Novel” air gap jumping techniques (HDD lights, high-frequency audio, …)
• “Novel” sideband communication techniques (Steganography, communication via processor cache latency)

Ultimately, computers are amazing at encoding data and communicating in various ways, and humans are amazing at inventing various ways. Put these together, and you get an infinite river of InfoSec articles! We can sustain a whole industry this way! Proof positive that perpetual motion machines are not only possible, but actually exist.

When optimizing website performance, the performance tools that Google has built are magical.

One place I started when working on my site’s revamp was Google’s PageSpeed Insights. After running an analysis on my home page, I saw this warning:

Almost a second of my site’s page load time was caused by loading non-critical CSS. You can use the “Coverage” tool in Chrome’s dev tools to dig into this deeper:

When hosting a static website or blog, you ultimately have to tackle the question: “What about the comments?”. Statique provides a simple, self-hosted option.

When working with raw binary data (especially in security forensics), it is common to need to write parsers for this binary data. For example, extracting file contents out of the NTFS data structures on disk. For many common data structures, there are already binary parsers written for them that you can leverage, but you’ll still sometimes need to write your own. BinShred is a PowerShell module that lets you do this.