Incident Analysis

Would your org have caught the Shai-Hulud npm worm? A checklist

Shai-Hulud spread by stealing developer tokens and republishing packages. Use this checklist to see which controls would have limited it in your org.

Would your org have caught ProxyLogon? A detection checklist

ProxyLogon let attackers run code on internet-facing Exchange servers. Check whether your patching, exposure and log review would have caught it in time.

MOVEit Transfer attack: timeline and what defenders should learn

In May 2023 CL0P exploited a zero-day SQL injection in MOVEit Transfer to steal data. Timeline from CISA plus lessons on exposure and data minimization.

Maersk and NotPetya: timeline and what defenders should learn

NotPetya spread through a poisoned accounting update on 27 June 2017 and hit Maersk. Sourced timeline plus lessons on identity, segmentation and recovery.

Kaseya VSA attack, eight questions to test your RMM and MSP exposure

CISA and FBI guidance after the July 2021 Kaseya VSA attack gives a practical checklist. Eight questions to see if your org or MSP would have held up.

Exchange ProxyShell timeline, from quiet patches to mass exploitation

ProxyShell chained three Exchange bugs that were patched in spring 2021 and exploited from August. A dated timeline and what defenders should take from it.

Zero day response: eight mistakes teams make in their first year

Mistakes teams make in year one of zero day response, from having no inventory to never rehearsing, with fixes you can start this month and measure.

A zero day from alert to fix, a worked example in six stages

A constructed timeline of a newly public library flaw, from advisory to proof of fix. See what to ask, what to do first and what to record along the way.

XDR worked example: correlating a phishing alert to containment

A constructed XDR case that links an email alert, an odd sign-in and an endpoint event into one incident, then contains it and learns from it.

Threat intelligence to action: a constructed example, step by step

A constructed example of a threat intelligence report becoming action, from first read to closed tasks, showing how to judge relevance and what to change.