> For the complete documentation index, see [llms.txt](https://rootguard.gitbook.io/cyberops/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rootguard.gitbook.io/cyberops/welcome/readme.md).

# RootGuard

Practical cybersecurity investigation, detection and defensive engineering

**Security operations. Detection engineering. Digital forensics.**

RootGuard is an independent technical reference for security practitioners investigating incidents, developing detections and strengthening defensive environments. Start with a task, follow the evidence, and use the linked procedures as a starting point for your own authorised environment.

## Start with your objective

| I need to…                                                             | Go to                                                                                                     |
| ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| Investigate phishing, ransomware, credential theft or lateral movement | [Operational incident playbooks](/cyberops/end-to-end-incident-playbooks/end-to-end-playbooks.md)         |
| Collect and interpret Windows endpoint evidence                        | [DFIR field guides](/cyberops/dfir-field-guides/field-guides.md)                                          |
| Build or review an AD or identity detection                            | [Detection engineering](/cyberops/detection-engineering/threat-detection.md)                              |
| Understand a technique or forensic artefact                            | [Digital forensics and incident response](/cyberops/defensive-security/dfir.md)                           |
| Study a topic systematically                                           | [Learning paths](/cyberops/welcome/learning-paths.md)                                                     |
| Find contributor standards and review status                           | [Documentation standards](https://github.com/andranglin/Cyber-Shields/tree/master/contributing/README.md) |

## Featured operational resources

### Incident investigation

* [Phishing compromise](/cyberops/end-to-end-incident-playbooks/end-to-end-playbooks/phishing-compromise.md): trace email delivery, user activity, endpoint evidence and account exposure.
* [Ransomware response](/cyberops/end-to-end-incident-playbooks/end-to-end-playbooks/ransomware.md): scope encryption, attack paths, backup impact and controlled recovery.
* [Credential theft](/cyberops/end-to-end-incident-playbooks/end-to-end-playbooks/credential-theft.md): examine sign-ins, changes to credentials, permissions and sessions.
* [Lateral movement](/cyberops/end-to-end-incident-playbooks/end-to-end-playbooks/lateral-movement.md): correlate logons, processes and remote administration.

### Investigation foundations

* [Windows endpoint triage](/cyberops/dfir-field-guides/field-guides/windows-endpoint-triage.md)
* [Evidence acquisition and integrity](/cyberops/dfir-field-guides/field-guides/evidence-acquisition-and-integrity.md)
* [Windows forensic artefact interpretation](/cyberops/dfir-field-guides/field-guides/windows-artifact-interpretation.md)

## How to use this reference

**1. Check the prerequisites.** Identify the product and query execution environment, the required audit settings, retention and permissions.

**2. Investigate, then corroborate.** A matching event is an observation, not a finding of compromise. Correlate multiple sources and document limitations.

**3. Control operational changes.** Containment and eradication require appropriate authorisation, evidence preservation and post-action checks.

**4. Verify validation status.** Many examples are conceptual or have undergone static safety review only. They are not presented as production-certified detections.

See the [runbook validation framework](https://github.com/andranglin/Cyber-Shields/tree/master/defensive-security/dfir/runbooks/runbook-execution-validation-matrix.md) before relying on operational scripts.

## About RootGuard

RootGuard maintains separate **operational playbooks**, **technical references** and **optional practical exercises**. The primary purpose is to support real defensive investigations, not to present fictional datasets as operational tooling.

[Start Here](/cyberops/welcome/readme/start-here.md) · [About the Author](/cyberops/welcome/readme/who-am-i.md) · [Contributing and technical standards](https://github.com/andranglin/Cyber-Shields/tree/master/contributing/README.md)