Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to services.

Collection

Format

Guided LabConstructed

Guided lab: a service that existed for nine seconds

Remote execution over the admin share, reconstructed from the target. Tie four events in three logs into one action, work back to the host it came from, and handle the version where the service is not called PSEXESVC.

21 Sept 2026about 45 minutes of workT1021.002T1569.002lab constructed lateral-movement psexec

Guided Lab

Guided lab: a service that starts before you do

Windows services run as SYSTEM and start before anyone logs in, which makes them the most valuable persistence on the box and the hardest to spot among the two hundred already there. Part three of the persistence series.

31 Aug 20265 min readT1543.003lab persistence services sysmon