Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to t1059.001.

Collection

Format

AnalysisConstructed

Mini-guide: a PowerShell alert in ninety seconds, in the order that settles it fastest

Most PowerShell alerts are administration. Five questions, ordered so the cheapest one that can close the alert comes first, with the answer that means stop and the answer that means keep going.

21 Sept 20263 min readT1059.001guide constructed powershell triage