⟩ Blue Team Operations
DFIR
Incident Response
Containment, eradication and recovery for active breaches.
What I deliver
- Live triage & memory forensics
- Root-cause analysis
- Post-incident hardening
⟩ real-world projects
Selected engagements
Sanitized highlights from real client work — approach, the bug we found, and the fix shipped. Names redacted under NDA.
01
Live ransomware IR for logistics firm — contained in 6 hours, restored ops in 36 hours
02
BEC investigation across O365 tenant — full mailbox rules + OAuth grant audit, attacker evicted
⟩ common vulnerabilities & how I find them
Top bugs I hunt — and the steps
The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.
01
CriticalRansomware Outbreak
- STEP 1Isolate impacted hosts via EDR network-contain
- STEP 2Collect triage (KAPE) + memory (DumpIt) from patient-zero
- STEP 3Identify family, encryption scope, exfil channel; revoke credentials
- STEP 4Recover from immutable backups; harden RDP + MFA + EDR coverage
02
HighBusiness Email Compromise
- STEP 1Pull O365 UAL + MailItemsAccessed, audit OAuth consent grants
- STEP 2Identify malicious inbox rules, forwarding, MFA registration changes
- STEP 3Revoke sessions, reset creds, remove rules + rogue apps
- STEP 4Enable phishing-resistant MFA + conditional access + impossible-travel alerts
03
HighInsider Data Exfiltration
- STEP 1Baseline normal outbound data volume per user/role via DLP and proxy logs
- STEP 2Hunt for anomalous archive creation, USB writes, or bulk cloud-storage uploads before resignation dates
- STEP 3Correlate with HR events (notice period, PIP) and privileged access changes
- STEP 4Fix: DLP on egress channels, offboarding checklist with immediate access revocation, least-privilege by default
⟩ arsenal
Tools & frameworks
Volatility
Memory Forensics
KAPE
Triage Collection
Velociraptor
DFIR Platform
Autopsy
Disk Forensics
FTK Imager
Disk Imaging
Plaso
Timeline Analysis
RegRipper
Registry Forensics
YARA
Pattern Matching
Magnet AXIOM
Security Tool
Chainsaw
Security Tool
⟩ engage
Need incident response expertise?
⟩ related