HTB Sherlock ProcNet writeup analyzing a simulated Sliver C2 intrusion through PCAP and API Monitor data, covering JA3 fingerprinting, execute-assembly, credential access, lateral movement, and NTDS.dit dumping.
HTB Sherlock Caught writeup covering Active Directory DFIR, malicious shortcut analysis, Sliver C2, credential dumping, GPO abuse, and WMI persistence.
HTB Sherlock Easy Money writeup covering giveaway lure malware, Yandex Browser CVE clues, PowerShell, DLL hijacking, and Windows forensics.
HTB Sherlock SillyEli writeup covering BYOD compromise, fake MS Teams installer malware, PowerShell, scheduled tasks, and reverse shell analysis.
HTB Sherlock Safecracker writeup covering ransomware investigation, Windows and WSL artifacts, malware analysis, timeline reconstruction, and IOCs.
BKSEC TTV 2026 forensics author writeups covering disk, network, DPAPI, C2, malware, deobfuscation, and challenge design notes.
Search all indexed posts and pages. Shortcut: Ctrl K
Wheel to zoom - drag to pan - double-click reset
