Abd0_M0
Case studies
All case studies →Full investigations: scenario, evidence, analysis, findings and recommendations.
Credential theft from a Windows workstation memory image
A 4 GB memory capture, one suspicious process, and a path from initial execution to lateral movement.
Ransomware timeline rebuilt from NTFS artifacts
A super-timeline from the MFT, USN journal and event logs shows how the attacker got in and when encryption started.
Ransomware timeline rebuilt from NTFS artifacts
A super-timeline from the MFT, USN journal and event logs shows how the attacker got in and when encryption started.
Latest write-ups
All write-ups →Forensic artifacts, investigative methodologies, tools, and techniques.
Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder.
Detection
Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder.
Detection
Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder.
Detection
Contact
Open to SOC & DFIR work. Write to me about a role, a project, or one of the investigations on this site.