- A Hex Viewer That Knows It's Holding Evidence Most hex editors are built for programmers patching binaries. In DFIR, the file in front of you is usually evidence, and the jobs are different: prove it’s the file you...
- One Clock for Every Log Every intrusion I’ve worked ends up as the same question asked of six different logs: what happened around then? The proxy log says one thing, the event log another, the...
- Keeping the Whole Case in One Place Three hours into an incident, the case is everywhere. The timeline is in one tool, the process tree in another, the hashes are in a terminal you closed, the indicators...
- Knowing When You've Actually Contained an Intrusion The most dangerous sentence on an incident bridge is “we isolated the box.” It sounds like containment. Often it isn’t. The attacker moved off that host an hour ago, the...
- Learning pandas One Block at a Time Most DFIR triage I do eventually ends up in pandas. EvtxECmd, Hayabusa, PECmd and MFTECmd all hand you a CSV, and the questions are always the same: keep these rows,...
- Building DFIR Playbooks with Huddle Most incident response playbooks I’ve seen live in one of two places: a wiki page nobody has opened since the tabletop, or someone’s head. When the alert fires at 2...
- ADFIRWMC - 5.1 Did It Run? Evidence of Execution Welcome back. It has been a minute.
- Reverse-Engineering a FitRx EMS App into a Python Controller Short on time? Explore this post as a graph in Spoke: the decompiled app, the protocol, the Python controller, its safety features and what’s next, all as clickable nodes.
- Spoke: Seeing the Relationships in Your CSVs A lot of security data is really a graph pretending to be a spreadsheet. A process tree is parent and child PIDs. An insider risk case is users, hosts, files...
- What ChatGPT Wrote When I Asked It to Blog This is what I got from ChatGPT when I provided the following prompt:```Write a 500 word technical blog post about the Microsoft Defender for Endpoint API to perform Incident Response...
