August 2026
Fileless WMI Persistence: Hunting a Hijacked CIM Class (TryHackMe: After Hours
Turned out to be a fileless persistence chain: a legit-looking WMI class carrying a Deflate-compressed .NET loader as a "static property", fired by an EventFilter / CommandLineEventConsumer pair with…
July 2026
DFIR Cheatsheet — Windows Registry & Filesystem Artifacts
Reference card for Windows forensics: where to find evidence of execution, staging and exfiltration. Based on the classic "kill chain" order: Execution → Persistence → Access → Collection → Exfiltration.
June 2026
Incident response runbook
The six IR phases, what to do (and not do) in the first hour, and which log sources to check first.