Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to method.

Collection

Format

AnalysisConstructed

Mini-guide: pivoting on the logon ID, or how one number turns a log into a session

The Security log records events. An investigation needs sessions. The logon ID is the join between them: how to follow one from the logon through every process it started to the logoff, and the three places the thread breaks.

14 Oct 20263 min readT1078T1059guide constructed windows event-logs