Independent writing on digital forensics and security research.
4 posts from the blog archive.
A practitioner's framework for investigating potential LLM involvement in intrusions through adaptive tooling, version inconsistencies, parallel activity, pacing, coding patterns, and command-line behavior.
What modern intrusions look like after the textbook timeline falls apart—and how repeatable tradecraft and peripheral telemetry make sparse evidence defensible.
Exploring how agentic AI can support incident response by applying concurrent, methodical analysis across large telemetry sets.
Ransomware affiliates have long since abused Cloudflared tunnels to maintain persistent access to compromised environments.