Incident teardowns, detection engineering and adversary emulation, written the way they get written in a notebook: the artifact, the query that found it, the thing that turned out to be wrong, and the rule that came out the other end.
The Security log records events. An investigation needs sessions. The logon ID is the join between them: how to follow one from the logon through every process it started to the logoff, and the three places the thread breaks.
Read it →3 min readT1078T1059
Data staged with an archiver and sent out with a renamed copy of a legitimate sync tool. Identify the binary from one field, reconstruct what was taken from a command line, and be exact about what endpoint telemetry cannot tell you about volume.
An LSASS dump taken with a DLL that ships in System32, called by ordinal so the obvious rule misses it. Work out which process touched LSASS, which access mask matters, and whose credentials you now have to assume are gone.
Event 4624 has more than twenty fields and most triage reads two of them. The five that change the conclusion, what each one is really recording, and the values that catch people out.
A burst of Kerberos service ticket requests from one workstation, every one of them legitimate as far as the domain controller is concerned. Find what makes the cluster abnormal, separate it from a legacy application, and say what the log cannot tell you.
Security Artifacts is free to read. A membership adds the parts that take the longest to produce: full incident write-ups with the evidence attached, the rule packs, and the wire as a machine-readable export.
