Research

Mini-guide: pivoting on the logon ID, or how one number turns a log into a session

The Security log records events. An investigation needs sessions. The logon ID is the join between them: how to follow one from the logon through every process it started to the logoff, and the three places the thread breaks.

Guided lab: the mailbox rule that was not the point

A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.

Full write-up available to members subscribers. See what is included.