The official account for 13Cubed Studios LLC.
Georgia, USA
- Tweets 372
- Following 0
- Followers 8,295
- Likes 885
Pinned Tweet
🎉 Big news! Investigating macOS Endpoints is now live—plus our new *NIX Bundle and XPlat Bundle Complete (all 13Cubed courses in one package). Thanks for patiently waiting! Dive in now 👉 training.13cubed.com #DFIR #macOS #Linux
1
7
72
6,494
It's time for a new 13Cubed episode, and this one's a bit special.
I spent nearly six years at Microsoft. Then, right after getting promoted, I quit.
In this episode, I'm stepping away from the usual technical content to tell that story, and explain why I decided it was time to walk away.
▶️ piped.video/watch?v=OnavGwRI…
#DFIR #DigitalForensics #Forensics #ComputerForensics #WindowsForensics
1
5
28
3,226
🎉👇
🏆 What a finish to our September competition!
Participants tackled a real case simulating an Iranian APT campaign, tracing the attack through the evidence. The leaderboard stayed close throughout. 🔎
Congratulations to the top three:
🥇 Bombolone (Carlo Luciani) - Prize: "Investigating Windows Endpoints" course courtesy of @13CubedDFIR 🙏
🥈 @KoifSec - Prize: x2 months of Threat Hunting Labs access
🥉 aboelrous (Omar A.) - Prize: x1 month of Threat Hunting Labs access
Thanks to everyone who took part and made it such a great event! 🔥 The lab that was used in this competition is available for our labs subscribers with a full report.
Each question has a walkthrough video courtesy of Andrew from Empirical Training. Go check out his YouTube channel piped.video/@andrewcyberjone…
Check out 13Cubed Training courses: training.13cubed.com/
Lab: threathuntinglabs.com/threat…
4
1,482
13Cubed is proud to support the development of Fuji from @thelazza, our go-to tool for macOS forensic acquisition.
We were lucky enough to receive this limited-edition Fuji USB, pre-loaded and ready to make acquisitions even easier. 🔥
Check out Fuji in action 👇
piped.video/watch?v=9ZkLdFod…
3
21
1,450
Another impressively in-depth review of a 13Cubed course from Krzysztof Kuzin. This time, he takes a deep dive into Investigating Windows Memory (IWM).
Check out the full IWM review here 👉
krzysztofkuzin.substack.com/…
And if you missed his review of Investigating Windows Endpoints (IWE), you can find that here 👉
krzysztofkuzin.substack.com/…
Great to see these courses covered in this level of detail!
6
17
1,511
13Cubed retweeted
Threat Hunting League is open for registration with less than 10 days to go!
Intrusion: Iranian APT Campaign
Sep 25–27 · 4-hour personal lab run
Entry: $15 or 12 THL credits
Prizes:
1st — 13Cubed Investigating Windows Endpoints ($795)
2nd — 2 months of Threat Hunting Labs + a 30-minute coaching session
3rd — 1 month of Threat Hunting Labs
Thank you @13CubedDFIR for backing the first competition!
threathuntinglabs.com/compet…
5
16
2,095
🏆 Introducing the XPlat Forensic Investigator (XPFI) credential from 13Cubed.
Digital forensics doesn't stop at one OS. Real cases cross Windows, Linux, and macOS.
XPFI recognizes exactly that: earn certifications in four 13Cubed courses and you're recognized across all three major operating systems.
✅ Included, no extra cost
✅ No separate exam
✅ Issued automatically
✅ Never expires
Certification attempts have always been included with 13Cubed courses. XPFI is no different.
training.13cubed.com/certifi…
5
16
1,339
A new 13Cubed episode is out! 🍎
Windows forensics on a Mac usually means firing up a VM first. Not anymore.
IRFlow Timeline is a free, open-source DF/IR timeline tool built natively for macOS. Feed it EVTX, Plaso, $MFT, or $J and go straight to process inspection, lateral movement, persistence, and VirusTotal enrichment.
Featuring the tool's author, @r3nzsec 👇
piped.video/watch?v=W9xHbNgZ…
4
24
5,491
Tomorrow: a special guest episode of 13Cubed featuring @r3nzsec!
If you're a Mac user living in the Windows forensics world, you won't want to miss this one. 👀
2
1
11
2,084
🧟 Abeebus is back from the dead. v2.1 is out.
It pulls IPv4 addresses out of any file and gets GeoIP data for each one from ipinfo.io.
🔧 The big fix: it used to read the entire file into memory. Fine for email headers, not so great for a memory image. It streams now.
Also keeps your results if you hit the ipinfo.io rate limit.
If you prefer a native Windows binary, try SharpAbeebus.
github.com/13Cubed/Abeebus
github.com/13Cubed/SharpAbee…
6
12
1,434
The first 13Cubed mini course, Architecting the Hunt, is now available! 🎉
An entry-level, hands-on introduction to threat hunting, learn a repeatable framework, then put it to work in a self-contained lab. No prior experience needed.
Watch the launch video 👉 piped.video/watch?v=cFxwYz5T…
Enroll 👉 training.13cubed.com/archite…
#ThreatHunting #DFIR #BlueTeam
15
82
31,175
Coming this Monday, August 10!
The very first 13Cubed mini course is coming, and we couldn't be more excited! 🔥
🎯 Architecting the Hunt takes you from zero to confident threat hunter with a repeatable framework, then drops you into a hands-on lab with 100 hosts and 9M+ events to hunt through. 🕵️
✅ Entry-level
✅ Hands-on lab (yours to keep!)
✅ No experience needed
The waitlist is OPEN 👇
training.13cubed.com/archite…
1
1
6
1,421
13Cubed retweeted
Registration is open for the first Threat Hunting League competition
Prizes:
🥇 13Cubed’s Investigating Windows Endpoints course, worth $795 USD
🥈 Two months of complimentary Threat Hunting Labs access, plus a private 30-minute one-to-one threat hunting coaching session
🥉 One month of complimentary Threat Hunting Labs access
Investigate the Iranian APT Campaign Against Aerodyne Engineering and hunt for the evidence-based objectives.
- Competition window: September 25–27
- Personal lab run: 4 hours within that window
- Entry: $15 or 12 THL credits for active subscribers while allocation space remains
Open to all experience levels!
A big thank you to @13CubedDFIR for supporting our first Threat Hunting League competition!
threathuntinglabs.com/compet…
Made with AI
9
22
3,590
🔥👇
The very first 13Cubed mini course is coming, and we couldn't be more excited! 🔥
🎯 Architecting the Hunt takes you from zero to confident threat hunter with a repeatable framework, then drops you into a hands-on lab with 100 hosts and 9M+ events to hunt through. 🕵️
✅ Entry-level
✅ Hands-on lab (yours to keep!)
✅ No experience needed
The waitlist is OPEN 👇
training.13cubed.com/archite…
1
10
2,924
The very first 13Cubed mini course is coming, and we couldn't be more excited! 🔥
🎯 Architecting the Hunt takes you from zero to confident threat hunter with a repeatable framework, then drops you into a hands-on lab with 100 hosts and 9M+ events to hunt through. 🕵️
✅ Entry-level
✅ Hands-on lab (yours to keep!)
✅ No experience needed
The waitlist is OPEN 👇
training.13cubed.com/archite…
14
27
5,718
🔥 A new 13Cubed episode is out!
In this episode, we'll look at a tool that can run multiple Volatility 3 plugins simultaneously, automating your memory analysis and saving you valuable time during investigations.
👉 Watch now: piped.video/watch?v=0GMTydim…
#DFIR #DigitalForensics #IncidentResponse #MemoryForensics #Volatility3 #CyberSecurity
1
5
17
2,508
📣 I partnered with @13CubedDFIR for a summer giveaway! 🎁
🏆 Five winners will receive a 13Cubed course of their choice from the list below + a Retro Forensicator T-Shirt.
13Cubed Courses:
- Investigating Windows Endpoints
- Investigating Windows Memory
- Investigating Linux Devices
- Investigating macOS Endpoints
Each course comes with a Certificate of Completion as well as Certification attempts!
On August 1st, entries across social media platforms will be combined, and the five winners will be selected.
To Enter:
✅ Like
✅ Share
✅ Comment with the course you want to win the most
For more information ⬇️
Link to 13Cubed Training: training.13cubed.com/
13Cubed Merch Store: shop.13cubed.com/
#DFIR #IncidentResponse #DigitalForensics
80
78
99
7,316
🎉 A new 13Cubed episode is up!
This time we're exploring the USN Journal on a live system. How can we view it while Windows is actively running, and does the reality match the common explanations? Let's find out!
piped.video/watch?v=eSLHyqZl…
#DFIR #DigitalForensics
5
10
1,722
🍎 Happy #WWDC26 week!
🚀 We've just released a major update to Investigating macOS Endpoints, featuring an all-new hands-on macOS forensics scenario.
Put your investigative skills to the test in a realistic case environment and gain experience tackling challenges you'll encounter during real-world macOS investigations.
👉 piped.video/watch?v=tRvw13e3…
3
13
1,082
🎉 Today, we released a major update to Investigating Windows Endpoints, with significantly expanded content on registry forensics!
🔥 Next Monday is Apple's Worldwide Developers Conference (WWDC). Watch for another exciting update for Investigating macOS Endpoints!
training.13cubed.com
6
18
1,805
We're looking for a Core Ultra Series 3 laptop (32GB/1TB) for some forensic work, an upcoming video, and another "special" project.
Framework's Laptop 13 Pro was our first choice, but I don't think they're interested in allowing us to have early access. It's been years since we've purchased a PC laptop (we build our own desktops and use Mac laptops).
Recommendations?
3
7
2,474