Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to T1021.002.

Collection

Format

Guided LabConstructed

Guided lab: a service that existed for nine seconds

Remote execution over the admin share, reconstructed from the target. Tie four events in three logs into one action, work back to the host it came from, and handle the version where the service is not called PSEXESVC.

21 Sept 2026about 45 minutes of workT1021.002T1569.002lab constructed lateral-movement psexec