Abd0_M0Case studies
Full investigations: scenario, evidence, analysis, findings and recommendations.
All case studies
Credential theft from a Windows workstation memory image
A 4 GB memory capture, one suspicious process, and a path from initial execution to lateral movement.
Ransomware timeline rebuilt from NTFS artifacts
A super-timeline from the MFT, USN journal and event logs shows how the attacker got in and when encryption started.
Ransomware timeline rebuilt from NTFS artifacts
A super-timeline from the MFT, USN journal and event logs shows how the attacker got in and when encryption started.
Ransomware timeline rebuilt from NTFS artifacts
A super-timeline from the MFT, USN journal and event logs shows how the attacker got in and when encryption started.
Ransomware timeline rebuilt from NTFS artifacts
A super-timeline from the MFT, USN journal and event logs shows how the attacker got in and when encryption started.
Beaconing and data exfiltration in a PCAP
Finding regular C2 beacons and a DNS tunnel in a packet capture, then writing a detection for the pattern.
Nothing matches. Clear the search or pick another tag.