top of page


WELCOME
Welcome visitors to your site with a short, engaging introduction. Double click to edit and add your own text.
Search
Incident Response - After Action Review (AAR) Template
Highlighting and tracking improvement ideas and tasks derived from the incident using the 5 Why’s model to identify root causes and solution
brencronin
Jan 19, 20252 min read


Virtualization Monitoring & Incident Response - VMware
Virtualization platforms have become standard in many organizations and have been more commonly been exploited by threat actors.
brencronin
Jan 7, 202512 min read


Incident Response - Linux
Linux Incident Response Approach Overview When conducting incident response on Linux systems, certain types of analysis can be performed quickly and effectively using built-in Linux tools. This initial analysis often provides insights into how the system was compromised and the actions taken during the breach. However, advanced threat actors may employ techniques that complicate the investigation, requiring more time-consuming and sophisticated analysis methods. This Linux an
brencronin
Dec 11, 202430 min read


EDR Evaluation - EDR System Operations (SysOps)
EDR/XDR platforms often lack transparency in their detection logic.
brencronin
Dec 1, 202412 min read


Insider Threat
TSMC TSMC employees reportedly stole 2nm trade secrets to share with Rapidus — accused are said to have shared 'hundreds of process integration technical photos' https://www.tomshardware.com/tech-industry/semiconductors/tsmc-employees-reportedly-stole-2nm-trade-secrets-to-share-with-rapidus-accused-are-said-to-have-shared-hundreds-of-process-integration-technical-photos Peter Williams, Ex-ASD, Pleads Guilty to Selling Eight Exploits to Russia https://www.lawfaremedia.org/arti
brencronin
Nov 26, 20246 min read
Cyber Incident Response - Incident Communications Plan
Cyber Incident Response Communications Plan Purpose The purpose of this communications plan is to ensure secure, efficient, and...
brencronin
Aug 4, 20243 min read
Cyber Incident Response - Incident Declaration Policy,
Purpose The purpose of this policy is to establish a standardized process for the declaration of a cyber incident and the subsequent...
brencronin
Aug 4, 20243 min read


Adversary-in-the-Middle (AiTM) and Business Email Compromise (BEC)
Cyberattacks persistently target both systems and individuals. Among these, compromising user credentials stands out as a prevalent...
brencronin
Apr 17, 202412 min read


Malware Analysis - Encoding/Decoding to Mask/Unmask Hackers Dirty Deeds - Base64
One critical aspect of malware behavior lies in Data Obfuscation, where malware seeks to conceal its activities through various...
brencronin
Mar 9, 20245 min read


Ransomware - Techniques - Encryption via GPUpdate
Ensuring the security of an organization's Domain Controller (DC) is paramount, recognizing it as a critical asset that must be protected...
brencronin
Nov 15, 20232 min read
bottom of page