Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to plaso.

AnalysisMembers

Run key persistence: what the registry alone will not tell you

A lab reconstruction of a user-level persistence case, and why the Run key timestamp is the least useful thing in the artifact set.

18 Aug 20266 min readT1547.001TA0003windows persistence registry timeline

Full write-up available to members subscribers. See what is included.