Research

Mini-guide: what a Prefetch file proves, and the three things it cannot tell you

Prefetch is the best execution evidence most Windows workstations keep by default. What is inside a .pf file, how to read the eight run times, why two files for one program can be normal or a finding, and where it runs out.

Mini-guide: pivoting on the logon ID, or how one number turns a log into a session

The Security log records events. An investigation needs sessions. The logon ID is the join between them: how to follow one from the logon through every process it started to the logoff, and the three places the thread breaks.

Mini-guide: a PowerShell alert in ninety seconds, in the order that settles it fastest

Most PowerShell alerts are administration. Five questions, ordered so the cheapest one that can close the alert comes first, with the answer that means stop and the answer that means keep going.

Mini-guide: the five fields of a 4624 that decide what a logon means

Event 4624 has more than twenty fields and most triage reads two of them. The five that change the conclusion, what each one is really recording, and the values that catch people out.

False-Positive Hall of Fame No. 1: six alerts that were the software working

Chrome opens a pipe that Cobalt Strike also opens. Chrome's updater reads LSASS. Discord ships a signed binary that launches other binaries. Six alerts that fire on normal software, each with the benign explanation and the discriminator, and a count of how often the public rulebase admits any of this.

The operator set the clock, and set only one of them

Timestomping is a decision, not an accident, and the decision is visible. NTFS keeps eight timestamps per file and the ordinary Windows API writes four of them. What the other four say about the tool the operator chose, the checklist they were working from, and where they stopped.

Full write-up available to members subscribers. See what is included.

What ATT&CK actually is, and how to stop being intimidated by it

A beginner's guide to MITRE ATT&CK that does not open with the matrix. What it is, what it is not, why the giant grid is the worst way to meet it, and how to use it on a Tuesday afternoon rather than in a strategy deck.

Run key persistence: what the registry alone will not tell you

A lab reconstruction of a user-level persistence case, and why the Run key timestamp is the least useful thing in the artifact set.

Full write-up available to members subscribers. See what is included.

Emulating T1059.001 until the detection actually fires

Four variants of the same PowerShell technique, three of which walked past a rule that looked fine on paper. Notes from a purple team afternoon.

Full write-up available to members subscribers. See what is included.

Finding DNS tunnelling in a 4 GB capture without a signature

Entropy, subdomain cardinality and query-rate shape. Three statistics that find a covert channel faster than any rule matching a known tool.