2026-10-12 03:22Z INFO Managed Detection & Response · Security Analyst · Blue Team Operations
Field notes from the SOC
I'm an MDR team lead with nearly five years in the SOC. I investigate and remediate threats, hunt through telemetry, and write up the detections and playbooks I build along the way.
- research
- 6
- lab_notes
- 17
- years_soc
- ~5
- certs
- 5
The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion
- Opened
- 2026-09-29
- Tags
- Case File · Threat Response · Threat Hunting
- Length
- 8 min read
A memory-acquisition alert led back 17 hours to a KongTuke-style delivery chain, a portable Node.js RAT with Ethereum-based C2 resolution, WinRM enablement, and an attempted upload of a memory image to cloud storage.
Open case01Recent work
All research-
The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion
A memory-acquisition alert led back 17 hours to a KongTuke-style delivery chain, a portable Node.js RAT with Ethereum-based C2 resolution, WinRM enablement, and an attempted upload of a memory image to cloud storage.
-
PowerShell for Responders
A quick reference for reading an endpoint from a remote response shell: get the data, filter it down, and format it so nothing truncates, without writing anything to disk.
-
Browser History for Initial Access: Collecting and Querying Chromium History
When the EDR shows PowerShell or a suspicious download but not how the user got there, the browser's SQLite history usually does. Find the right profile, collect a copy, and query it in DB Browser for SQLite.
-
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response
Digital forensics and incident response lab investigating a REvil/Sodinokibi ransomware attack, covering initial access, privilege escalation, lateral movement, credential theft, and encryption using Splunk log analysis and malware analysis techniques.
02ATT&CK techniques covered
Detections, playbooks, and remediation guides, indexed by MITRE ATT&CK technique.
- T1068 Exploitation for Privilege Escalation 3
- T1218.005 Mshta 3
- T1204.004 Malicious Copy and Paste 2
- T1021 Remote Services 1
- T1036.005 Match Legitimate Name or Location 1
- T1053.005 Scheduled Task 1
- T1055 Process Injection 1
- T1059.001 PowerShell 1
- T1059.007 JavaScript 1
- T1081 Credentials in Files 1
- T1099 Timestomp 1
- T1102.001 Dead Drop Resolver 1
03Sections
Working on detection or threat response?
Happy to compare notes on hunting, detections, and MDR operations.