Upgrading My Home Lab: Adding a SIEM Stack on a Budget
After running a basic VM setup for a year, how I stood up
Elastic SIEM without spending money on hardware I did not need.
research blog
Threat hunting.
The most sophisticated actors.
Technical research across DFIR, malware analysis, threat hunting, and CTF write-ups. No product pitches, no fluff.
→
Rogue | HTB Forensics (Easy)
A pcap analysis challenge where credentials get stolen over an unencrypted protocol.
→
Amcache and Shimcache: The Artefacts Attackers Forget to Clean Up
Two Windows artefacts that consistently come up in
investigations because attackers rarely think to clear them.
→
Building Useful Splunk Dashboards for a Home SOC
Most Splunk tutorials show dashboards with clean data. Real log
data is messy. The searches that actually work.
→
DLL Side-Loading in Practice: A Walkthrough of a Real Sample
DLL side-loading keeps appearing in threat
reports. Breaking down a sample that used a legitimate signed binary as a loader.
→
Intentions | HTB Forensics (Hard)
Three days. A heavily obfuscated PowerShell dropper, a second-stage payload living
entirely in memory, and a flag hidden in a registry key that should not exist.
→
Windows Prefetch Files in Incident Response
Prefetch files can tell you what ran, when it ran, and sometimes from where -
even after the original executable has been deleted.
→
Detecting Mimikatz Without Signature-Based Rules
Mimikatz has hundreds of variants and most AV signatures fall
behind. Behavioural detection approaches that catch it regardless of version.
→
My Windows DFIR Checklist for Initial Triage
After working through enough incidents and CTF challenges, a checklist that
covers the things that matter most in the first 30 minutes.
→
Building a Home Lab for Threat Hunting and DFIR Practice
A walkthrough of setting up a home lab capable of supporting realistic DFIR and threat hunting practice. Covers hardware selection, network topology with VLANs, Sysmon configuration, and getting a full SIEM stack running on a budget.
→