topic
Triage
3 posts
-
PowerShell for Responders
A quick reference for reading an endpoint from a remote response shell: get the data, filter it down, and format it so nothing truncates, without writing anything to disk.
-
Browser History for Initial Access: Collecting and Querying Chromium History
When the EDR shows PowerShell or a suspicious download but not how the user got there, the browser's SQLite history usually does. Find the right profile, collect a copy, and query it in DB Browser for SQLite.
-
Email Analysis Investigation Guide
Investigating a suspicious email end to end: reading headers and authentication results correctly, extracting and decoding URLs and QR codes, validating attachments from the raw EML, and checking the sender domain.