Exploring SonicWall techSupport Exports
An overview of the forensic value contained within SonicWall techSupport packages, from authentication configuration to audit history and identity data.
Detecting & Responding to AI-aided or Agentic Attacks
A practitioner's framework for investigating potential LLM involvement in intrusions through adaptive tooling, version inconsistencies, parallel activity, pacing, coding patterns, and command-line behavior.
Read the postField notes
All field notes-
-
Hunting Anomalous Python Execution
A renamed Dropbox updater, a year-old staging link, and a prayer; surfacing CobaltStrike one hypothesis at a time.
-
Nezha RMM and a suspicious vmtools.exe SOCKS5 proxy
A short investigation note on a host where Nezha Chinese RMM led to a mislabeled Node runtime, SOCKS5 proxy payload, and PowerShell collection script.
More posts
All posts-
The Anatomy of the Modern Intrusion
What modern intrusions look like after the textbook timeline falls apart—and how repeatable tradecraft and peripheral telemetry make sparse evidence defensible.
-
Agentic AI for Incident Response
Exploring how agentic AI can support incident response by applying concurrent, methodical analysis across large telemetry sets.