Archive

Research

Incident teardowns, detection engineering, reverse engineering and network forensics.

Perfectly normal Windows behaviour that looks exactly like an intrusion. Every entry is something that has cost a real team a real night, with the benign explanation and the discriminator that separates it from the genuine article.