Field notes
Investigations and case write-ups.
What real intrusions look like and how they come apart under examination. Notes from the field, written by and for people who like technical details left in.
Jan 2026→Jan 2026→
Anatomy of a ClickFix-to-RAT campaign
A trojanized draw.io build, a lookalike C2 domain, and the chain of artifacts that gave it away.
DFIRSweeping common persistence, fast
The handful of registry keys, scheduled tasks, and services that account for most real-world persistence — and how to triage them in minutes.
Forensics