Investigation Log
Field Reports
A running series of full DFIR investigations — each one worked end-to-end against real tooling and real evidence: hunting, timeline correlation, and MITRE ATT&CK mapping. For quicker triage exercises, see the Case Studies section on the Home page.
A Windows event-log forensic investigation against the EVTX-ATTACK-SAMPLES corpus (277 EVTX files across a Tiny11 Windows 11 VM environment), tasked with identifying credential-use, persistence, and lateral-movement activity from raw log evidence — no pre-flagged alert to start from.
Used Chainsaw with Sigma detection rules to hunt across the full corpus, built a consolidated chronological timeline with EvtxECmd, then correlated parent/child process ancestry and timestamps to validate the two strongest leads before mapping confirmed behavior to MITRE ATT&CK.
Confirmed two high-value behaviors: WMI event-consumer
persistence on
PC04.example.corp (Sysmon Event ID 20
→ follow-on Event ID 1,
scrcons.exe -Embedding running as SYSTEM —
T1546.003), and WinRM-based lateral movement on
DC1.insecurebank.local (winrshost.exe
/ wsmprovhost.exe process chains under the
Administrator account, flagged by Chainsaw as a Remote
PowerShell Session — T1021.006). Both were
treated as leads until corroborated with event fields,
timestamps, and process relationships rather than accepted on
alert label alone.
Delivered a full attacker timeline and MITRE ATT&CK mapping with recommendations: monitor WMI event-subscription creation/modification, restrict and monitor WinRM exposure, enforce least-privilege on administrative accounts, and centralize Security/Sysmon logging for cross-event correlation.
A phishing email impersonating a bank/loyalty program (BRADESCO LIVELO) with a card-points-expiring lure, tasked with header/authentication analysis, static decoding of the embedded URL, and browser-based sandbox detonation to assess actual risk rather than assume malicious intent from the lure alone.
Inspected email headers and SPF/DKIM/DMARC authentication results, decoded the Base64 HTML body with CyberChef to extract the embedded URL, checked the URL's history via urlscan.io, then detonated it in ANY.RUN's browser-based sandbox to observe live behavior — consolidating everything into an IOC table before mapping only evidence-supported behavior to MITRE ATT&CK.
Assessed as suspicious — phishing attempt with inconclusive payload observation rather than a hard malicious/benign call: header anomalies (SPF TempError, DKIM none, DMARC TempError, From/Return-Path mismatch) and a brand-impersonating, urgency-themed lure supported T1566.002 (Spearphishing Link) at high confidence, but the sandboxed URL failed to resolve during dynamic analysis, so payload behavior was explicitly documented as unconfirmed rather than assumed clean. Techniques without supporting evidence (credential capture, persistence, C2) were deliberately left unmapped.
Delivered a defensible verdict distinguishing confirmed findings from potential impact, plus recommendations: block/quarantine the identified URL, search mail logs for the same sender/IP/URL pattern across other recipients, apply safe-link sandboxing, and re-analyze the landing page if a live historical copy becomes available to close the evidence-dating gap.