- Knowing When You've Actually Contained an Intrusion The most dangerous sentence on an incident bridge is “we isolated the box.” It sounds like containment. Often it isn’t. The attacker moved off that host an hour ago, the...
- Learning pandas One Block at a Time Most DFIR triage I do eventually ends up in pandas. EvtxECmd, Hayabusa, PECmd and MFTECmd all hand you a CSV, and the questions are always the same: keep these rows,...
- Building DFIR Playbooks with Huddle Most incident response playbooks I’ve seen live in one of two places: a wiki page nobody has opened since the tabletop, or someone’s head. When the alert fires at 2...
- ADFIRWMC - 5.1 Did It Run? Evidence of Execution Welcome back. It has been a minute.
- Reverse-Engineering a FitRx EMS App into a Python Controller Short on time? Explore this post as a graph in Spoke: the decompiled app, the protocol, the Python controller, its safety features and what’s next, all as clickable nodes.
- Spoke: Seeing the Relationships in Your CSVs A lot of security data is really a graph pretending to be a spreadsheet. A process tree is parent and child PIDs. An insider risk case is users, hosts, files...
- What ChatGPT Wrote When I Asked It to Blog This is what I got from ChatGPT when I provided the following prompt:```Write a 500 word technical blog post about the Microsoft Defender for Endpoint API to perform Incident Response...
- Kernel-Level Access with Live Response There are times when security is annoying. As an example, when the Administrator account or even the SYSTEM account cannot access a file due to restrictions against accessing volume artifacts....
- Running Arbitrary Commands with Live Response Running Arbitrary Commands on an Endpoint via the API
- Using the API for Live Response Adding a file to the MDE Live Response Library and Running it on an Endpoint
