Exploring SonicWall techSupport Exports
An overview of the forensic value contained within SonicWall techSupport packages, from authentication configuration to audit history and identity data.
The Anatomy of the Modern Intrusion
What modern intrusions look like after the textbook timeline falls apart—and how repeatable tradecraft and peripheral telemetry make sparse evidence defensible.
Read the postField notes
All field notes-
-
Hunting Anomalous Python Execution
A renamed Dropbox updater, a year-old staging link, and a prayer; surfacing CobaltStrike one hypothesis at a time.
-
Nezha RMM and a suspicious vmtools.exe SOCKS5 proxy
A short investigation note on a host where Nezha Chinese RMM led to a mislabeled Node runtime, SOCKS5 proxy payload, and PowerShell collection script.
More posts
All posts-
Agentic AI for Incident Response
Exploring how agentic AI can support incident response by applying concurrent, methodical analysis across large telemetry sets.
-
Topology Beats Noise: Entity-Centric Detection of SSLVPN Abuse
Building an entity-centric ES|QL hunting model for SSLVPN abuse by prioritizing topology over raw alert volume.