August 4, 2026
The Anatomy of the Modern Intrusion
What modern intrusions look like after the textbook timeline falls apart—and how repeatable tradecraft and peripheral telemetry make sparse evidence defensible.
Notes from threat hunting, malware analysis, and DFIR
I am Mike (Rem). This is where I publish field notes, technical write-ups, and lessons learned from hands-on security work.
Type to search the site.
No content matched that search.
What I write about
-
Live investigations
Case-driven write-ups from incident response and malware triage work.
-
Detection engineering
Practical detection content across YARA, Sigma, and telemetry-first workflows.
-
Security research notes
Supply-chain abuse, protocol behavior, and CTF-style problem solving.
Recent posts
View all posts-
-
March 15, 2026
Agentic AI for Incident Response
Exploring how agentic AI can support incident response by applying concurrent, methodical analysis across large telemetry sets. We examine where specialized agents fit into PICERL workflows, how adversarial review helps control false positives, and why orchestration matters in real-world investigative environments.
-
February 18, 2026
Topology Beats Noise: Entity-Centric Detection of SSLVPN Abuse
Building an entity-centric ES|QL hunting model for SSLVPN abuse by prioritizing topology over raw alert volume. We explore how infrastructure reuse, cross-organization overlap, and short authentication time deltas can separate adversarial activity from benign noise at scale.
-
September 6, 2025
SSLVPN Honeypots: Fortigate Findings & Musings
Examining patterns observed in operating and collecting data from an SSLVPN honeypot sitting behind a Finch proxy.
Recent field notes
View all notes-
Exploring SonicWall techSupport Exports
An overview of the forensic value contained within SonicWall techSupport packages, from authentication configuration to audit history and identity data.
-
Hunting Anomalous Python Execution
A renamed Dropbox updater, a year-old staging link, and a prayer; surfacing CobaltStrike one hypothesis at a time.
-
Nezha RMM and a suspicious vmtools.exe SOCKS5 proxy
A short investigation note on a host where Nezha Chinese RMM led to a mislabeled Node runtime, SOCKS5 proxy payload, and PowerShell collection script.