- Building DFIR Playbooks with Huddle Most incident response playbooks I’ve seen live in one of two places: a wiki page nobody has opened since the tabletop, or someone’s head. When the alert fires at 2...
- ADFIRWMC - 5.1 Did It Run? Evidence of Execution Welcome back. It has been a minute.
- Reverse-Engineering a FitRx EMS App into a Python Controller Short on time? Explore this post as a graph in Spoke: the decompiled app, the protocol, the Python controller, its safety features and what’s next, all as clickable nodes.
- Spoke: Seeing the Relationships in Your CSVs A lot of security data is really a graph pretending to be a spreadsheet. A process tree is parent and child PIDs. An insider risk case is users, hosts, files...
- What ChatGPT Wrote When I Asked It to Blog This is what I got from ChatGPT when I provided the following prompt:```Write a 500 word technical blog post about the Microsoft Defender for Endpoint API to perform Incident Response...
- Kernel-Level Access with Live Response There are times when security is annoying. As an example, when the Administrator account or even the SYSTEM account cannot access a file due to restrictions against accessing volume artifacts....
- Running Arbitrary Commands with Live Response Running Arbitrary Commands on an Endpoint via the API
- Using the API for Live Response Adding a file to the MDE Live Response Library and Running it on an Endpoint
- Building a Quick Defender for Endpoint API Wrapper Building a Wrapper for MDE interactions
- Multifactor Access to the Defender for Endpoint API I have decided to dust off the ol’ blog to start documenting some of my more recent endeavors leveraging the Microsoft 365 Security suite to perform Incident Response. Since I...
