Documenting adversary tradecraft.
One artifact at a time.

This site is a living record of a real-world DFIR investigation following a directed 0-day attack on a Windows workstation. Each post walks through a phase of the response — from initial triage to root cause analysis — with the goal of turning an incident into a demonstrable skillset.