Archive
Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to sysmon.
Data staged with an archiver and sent out with a renamed copy of a legitimate sync tool. Identify the binary from one field, reconstruct what was taken from a command line, and be exact about what endpoint telemetry cannot tell you about volume.
An LSASS dump taken with a DLL that ships in System32, called by ordinal so the obvious rule misses it. Work out which process touched LSASS, which access mask matters, and whose credentials you now have to assume are gone.
Most PowerShell alerts are administration. Five questions, ordered so the cheapest one that can close the alert comes first, with the answer that means stop and the answer that means keep going.
Plant a scheduled task with Atomic Red Team, then find it four ways and work out which one survives an attacker who names their task properly. Closes the loop on the persistence you found on the domain controller in the Northwind case.
Windows services run as SYSTEM and start before anyone logs in, which makes them the most valuable persistence on the box and the hardest to spot among the two hundred already there. Part three of the persistence series.
A first investigation for anyone who has read about persistence but never gone looking for it. You will plant a Run key with Atomic Red Team, then find it three different ways and work out which of the three you would actually trust in production.
WMI event subscriptions run code on a condition you choose, survive reboots, live nowhere in the filesystem, and log nothing by default. The last of the persistence series, and the one that changes how you think about the other three.
Six months of a detection lab that was impressive to look at and useless to work in, and the four changes that fixed it.
