Blog
Research, workflow writeups, and DFIR methodology
This layout is designed to help you publish technical content that supports your tools and builds authority over time.
This layout is designed to help you publish technical content that supports your tools and builds authority over time.
A practical look at how OAuth abuse occurs, why it can be difficult to detect, and which authentication, audit, and activity logs matter during investigation.
A practical look at why interactive sign-in logs matter, what they represent, and how authentication telemetry helps investigators reconstruct modern cloud and identity-based attacks.
A perspective on why DFIR is not simply “looking at logs,” but reconstructing adversary behavior through distributed forensic telemetry, identity evidence, and investigative context.
Coming soon