001
RESEARCH PLAN2026
Windows Persistence: Mechanism to Evidence
Examining how persistence works at the operating-system level and what investigators can reconstruct after execution.
DFIRUPCOMING
RESEARCH ARCHIVE
Writing
Technical investigations organized around one standard: explain the mechanism, preserve the evidence, and leave defenders with something usable.
All writingWindowsDFIRDetectionMalwareThreat hunting
PUBLISHING PRINCIPLE
A write-up is finished when another defender can understand the behavior, reproduce the investigation, and challenge the conclusion.