Archive
Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to constructed.
A password spray that stayed under the lockout threshold and never produced a failed-logon event on the server it was aimed at. Find where the failures were recorded, identify the account that fell, and explain why the dashboard showed nothing.
Remote execution over the admin share, reconstructed from the target. Tie four events in three logs into one action, work back to the host it came from, and handle the version where the service is not called PSEXESVC.
An LSASS dump taken with a DLL that ships in System32, called by ordinal so the obvious rule misses it. Work out which process touched LSASS, which access mask matters, and whose credentials you now have to assume are gone.
Event 4624 has more than twenty fields and most triage reads two of them. The five that change the conclusion, what each one is really recording, and the values that catch people out.
A burst of Kerberos service ticket requests from one workstation, every one of them legitimate as far as the domain controller is concerned. Find what makes the cluster abnormal, separate it from a legacy application, and say what the log cannot tell you.
Most PowerShell alerts are administration. Five questions, ordered so the cheapest one that can close the alert comes first, with the answer that means stop and the answer that means keep going.
