Let’s talk

Growing MSSP with Offensive Services

Authentication beyond the domain

Trace compromised VPN access into the network

NTLM logons supplied the initial signal on internal servers. I connected their source addresses to non-domain devices and then to VPN sessions. VirusTotal and AbuseIPDB provided external-IP reputation context; the access history and network activity supplied the evidence of what those sessions did.

VPN logsNTLMNetwork analysisVelociraptorIP attributionVirusTotalAbuseIPDBIncident timeline reconstruction
Return to the full story ←

Your exploration

Viewed history

Saved only in this browser.

Ask my portfolio

Ask about my work.

Skills, achievements, technical detail. Follow the evidence.

Every answer links to the work.
How this works

When AI is connected, your question, recent questions and relevant published pages are sent to MiniMax to select supporting passages. Otherwise, this searches the site directly. Answers quote the saved website and link to their sources. This website does not save chat transcripts. Clearing or leaving the page clears this conversation.