Let’s talk

Growing MSSP with Offensive Services

The artefacts that connected the sequence

Vishing investigation without the original EDR logs

Prefetch linked execution of curl, tar and rundll32 with associated .bat and .dll filenames. I checked those indicators in VirusTotal and ANY.RUN, then correlated browser and Outlook artefacts with Quick Assist logs and Microsoft WebView activity. The support session preceded malicious execution.

Incident responseWindows forensicsDigital forensicsIncident timeline reconstructionThreat intelligence analysisVirusTotalANY.RUNEndpoint detection & response (EDR)SentinelOne
Return to the full story ←

Your exploration

Viewed history

Saved only in this browser.

Ask my portfolio

Ask about my work.

Ask about an investigation, a technology or my contribution. Answers link to the relevant case and technical detail.

Every answer links to the work.
How this works

When AI is connected, your question, recent questions and relevant published pages are sent to MiniMax to select supporting passages. Otherwise, this searches the site directly. Answers quote the saved website and link to their sources. This website does not save chat transcripts. Clearing or leaving the page clears this conversation.