Field notes
Investigations and case write-ups.
What real intrusions look like — and how they come apart under examination. Notes from the field, written for people who like the technical detail left in.
Jan 2026 → Jan 2026 →
Anatomy of a ClickFix-to-RAT campaign
A trojanized draw.io build, a lookalike C2 domain, and the chain of artifacts that gave it away.
DFIRSweeping common persistence, fast
The handful of registry keys, scheduled tasks, and services that account for most real-world persistence — and how to triage them in minutes.
Forensics