Welcome
Welcome to defencia.dk. This site is dedicated to the teaching and outreach work I do in my spare time. I hope you find it a source of inspiration for your daily work in infosec.
My intention is to share these resources so they reach the right audience. If you are enrolled in one of my courses, you will of course receive all the relevant material, which you are welcome to use within your company.
I have added a good deal of content on the governance side. Consider it a helping hand for the SMBs that struggle to get a grip on their governance. Use the templates as needed and adapt them to your business.
If something is missing, or you have feedback, feel free to write to me. Have fun!
Guides & workflows
One-page guides to the tools and workflows I use in DFIR and threat-intel work. Each guide is self-contained, copyable and built for quick reference.
Autopsy
Graphical forensics platform built on The Sleuth Kit. Analyse disk images, build timelines, search keywords, carve deleted files and run automated artifact modules in a case-oriented interface.
Åbn guide →Velociraptor
Open-source endpoint monitoring and digital forensics. Collect artifacts, hunt threats and run live response across thousands of machines via VQL — Velociraptor Query Language.
Åbn guide →KAPE
Kroll Artifact Parser and Extractor. Collects and parses the most relevant artifacts from a live or mounted Windows system in minutes — built for fast triage when time is critical.
Åbn guide →ClamAV & YARA
A comprehensive function and command reference for both tools — tailored to Linux (Zorin / Ubuntu). Click a code example to copy it.
Åbn reference →Kasm Workspaces
Stream containerised desktops and apps in the browser. Each session is a disposable environment reset on logout — ideal for suspicious links, malware detonation and phishing analysis without touching your own machine.
Åbn guide →Docker
Container runtime and the foundation under nearly every self-hosted service. Package an application with all its dependencies into an isolated, reproducible image and run it identically on any Linux host.
Åbn guide →n8n
Self-hosted workflow automation with a visual node editor. Connect APIs, databases and services into pipelines — run as a Docker Compose stack with PostgreSQL behind it.
Åbn guide →OpenCVE
Self-hosted platform to monitor CVEs and get notified when vulnerabilities hit the products and technologies you subscribe to. The trigger source for your enrichment pipeline via webhooks.
Åbn guide →CVE-berigelse
An n8n workflow that receives a webhook from OpenCVE, enriches the CVE with data from NVD and EPSS, and writes a combined record to your dashboard database. A reference pattern with importable JSON.
Åbn workflow →Miniflux
A minimalist, fast RSS reader in Go — one binary, low resource use. Perfect as the feed engine behind automation via its REST and Fever APIs.
Åbn guide →Nyheds-screening
An n8n workflow that fetches unread articles from Miniflux, lets a Mistral model decide relevance, enriches the relevant ones into short threat-intel summaries, and marks everything as read. Importable JSON.
Åbn workflow →Knowledge base
The full body of DFIR, forensics and governance material from defencia.dk — condensed into short, focused topic pages. Originally course material taught at KEA.
Emergency Handling & DFIR
Readiness, war room, write-blocking and the digital toolbox.
Read →The Phases
The IR lifecycle — preparation through lessons learned (NIST/SANS).
Read →Emergency Management
Knowing your capabilities, preparing for the worst, triage.
Read →Important Questions
Investigative checklist — what, who, where, when and why.
Read →Jump-bag
The grab-and-go DFIR kit — what to pack and why.
Read →Action Cards
Downloadable IR playbooks (CC 4.0).
Read →DFIR Links
Curated references — frameworks, samples and tools.
Read →Forensics & Analysis
Write protection, storage, and the Autopsy framework.
Read →Chain of Custody
Documenting evidence handling for court.
Read →Data Collection
Controlled acquisition, the right questions, integrity.
Read →Hashing
Hash values for integrity and identifying identical files.
Read →Memory Forensics
Volatility 3 — RAM artifacts and worked cases.
Read →USB for Live Forensics
Building a tested live-forensics USB.
Read →Autopsy Plugins
Custom plugins — URLcheck, Pi-hole, MalwareIndicator.
Read →Malware Analysis
REMnux — static triage and dynamic detonation.
Read →Malware Lab
Self-hosting Assemblyline on Docker.
Read →Labs for Analysis
Forensic/malware lab hardware and ready-made VMs.
Read →Loki
Scan for known YARA rules and hash IOCs.
Read →GDPR
Principles, data subject rights and breach handling.
Read →Paragraphs (DK law)
Danish criminal-law sections on cyber offences.
Read →Templates
Governance document templates (BIA, AUP, NDA…).
Read →Intelligence in Business
Cheap threat intel via RSS monitoring.
Read →Abbreviations
DFIR and governance glossary.
Read →Linux
A gentle intro to Linux for DFIR.
Read →Windows CMD
Useful built-in Windows commands.
Read →Software
The DFIR toolset and licensing.
Read →Backup
3-2-1, cloud options and encryption.
Read →Course & Peripherals
Minimum hardware to get started on a budget.
Read →Literature
Course books + the site as an e-book.
Read →Sites for Learning
Practice cases and challenges for self-study.
Read →Study & Productivity
Screen capture and mind-mapping tools.
Read →Santafun Mini CTF
A festive memory-forensics challenge.
Read →About
What Defencia means and who is behind it.
Read →Talks & presentations
Material from the talks I have given over the years. Download them freely and (hopefully) be inspired. Where a hash is given, you can verify the file's integrity.
Your Data, Your Evidence — B-sides
B-sides 2023 & Cyberskills
Vejen til Infosec (The road to infosec) & governance
Contact
Is something missing, or do you have feedback? Write to info [at] skrivebeskyttet [dot] dk. Your input is greatly appreciated.