Act I · Red
The Crime
We run the attack on a disposable Active Directory range and watch it land — the real command, the real foothold, nothing staged.
DFIR field notes · an investigator's diary
Every intrusion is a case. We walk it three times — once as the attacker, once as the defender, and once as the detective who reads what the disk, the registry and the directory never meant to confess.
“The logs are not what they seem.”
No screenshots without context. Every technique is executed, mitigated and investigated on a real lab — and we teach you to read the trace raw.
The Lab
There is no lab of mine to log into: I teach you to stand up your own disposable range and add layers to it, so you attack, defend and investigate on it. Step by step.
Act I · Red
We run the attack on a disposable Active Directory range and watch it land — the real command, the real foothold, nothing staged.
Act II · Green
One control, applied to the live range, and the same command dies. Attack, harden, re-attack — the defense proven, not asserted.
Act III · Blue
We acquire the disk, mount it cold and read the native artifacts — registry, MFT, the directory itself. Only the evidence, and how to read it.
Real investigations, anonymized. Coming soon.
Stand up your disposable range and add layers: attack, hardening, forensics. Step by step.
masstin, boromir, sabonis, vshadow-rs… home-grown DFIR in Rust.
What trace each action leaves on Windows and Linux — and how to read it raw.
The city and its own: events, Facendera Hacking, forest routes and good food.
Who investigates, why, and the lore behind it all.
«A damn fine cup of coffee.»
Agent Cooper · the philosophy of the case: calm, good coffee and good humor under pressure.