Incident teardowns, detection engineering and adversary emulation, written the way they get written in a notebook: the artifact, the query that found it, the thing that turned out to be wrong, and the rule that came out the other end.
Prefetch is the best execution evidence most Windows workstations keep by default. What is inside a .pf file, how to read the eight run times, why two files for one program can be normal or a finding, and where it runs out.
Read it →3 min readT1204.002T1070.004
The Security log records events. An investigation needs sessions. The logon ID is the join between them: how to follow one from the logon through every process it started to the logoff, and the three places the thread breaks.
Data staged with an archiver and sent out with a renamed copy of a legitimate sync tool. Identify the binary from one field, reconstruct what was taken from a command line, and be exact about what endpoint telemetry cannot tell you about volume.
An LSASS dump taken with a DLL that ships in System32, called by ordinal so the obvious rule misses it. Work out which process touched LSASS, which access mask matters, and whose credentials you now have to assume are gone.
Event 4624 has more than twenty fields and most triage reads two of them. The five that change the conclusion, what each one is really recording, and the values that catch people out.
Security Artifacts is free to read. A membership adds the parts that take the longest to produce: full incident write-ups with the evidence attached, the rule packs, and the wire as a machine-readable export.
