Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to active-directory.

Collection

Format

Guided LabConstructed

Guided lab: forty failures, no lockouts, one success

A password spray that stayed under the lockout threshold and never produced a failed-logon event on the server it was aimed at. Find where the failures were recorded, identify the account that fell, and explain why the dashboard showed nothing.

21 Sept 2026about 35 minutes of workT1110.003T1078.002lab constructed credential-access password-spraying

Guided LabConstructed

Guided lab: six service tickets in four seconds

A burst of Kerberos service ticket requests from one workstation, every one of them legitimate as far as the domain controller is concerned. Find what makes the cluster abnormal, separate it from a legacy application, and say what the log cannot tell you.

21 Sept 2026about 40 minutes of workT1558.003lab constructed credential-access kerberos