🔏
RootGuard
HomeSOC OperationsIncident ResponseWindows ForensicsLinux ForensicsKQL Investigations
  • Welcome
    • RootGuard
      • Who Am I?
        • Professional Profile
  • Resources Hub
    • Blogs
      • Articles
        • Safeguarding SMEs: The Strategic Importance of a Security Operations Center (SOC)
      • Posts
        • Roadmap to Becoming a Cybersecurity Specialist
        • Starting a Career in Cybersecurity
        • A Guide to Landing Your First Cybersecurity Analyst Role
        • Moving from Intermediate to Expert Incident Responder
  • SOC Operations
    • Introduction
      • Development Resources
        • SOC Analysts Roadmap
        • Becoming A SOC Analyst
        • SOC Analysts Prep Interview Questions
    • Essential Skills
      • Critical Windows EventIDs to Monitor
    • Junior Analyst Skills
      • Splunk Use Cases
      • KQL Use Cases
        • Reconnaissance (TA0043)
        • Initial Access (TA0001)
        • Execution (TA0002)
        • Persistence (TA0003)
        • Privilege Escalation (TA0004)
        • Defence Evasion (TA0005)
        • Credential Access (TA0006)
        • Discovery (TA0007)
        • Lateral Movement (TA0008)
        • Collection (TA0009)
        • Command and Control (TA0011)
        • Exfiltration (TA0010)
        • Impact (TA0040)
      • Investigating Common Attacks
        • Domain Dominance Attacks - Detection & Analysis
        • Investigating a Suspected AD FS Distributed Key Management (DKM) Attack
        • Authentication From Suspicious DeviceName
        • Identifying Interactive or RemoteInteractive Session From Service Account
        • Identifying Split or Part Archive File Transfers
        • Detect Potential Cleartext Credentials in Command Line
        • Detecting Command Line Interpreters Launched via Scheduled Tasks
        • Detecting Files Containing Potentially Sensitive Data
        • Detecting DeviceNetworkEvents From Windows Processes and Domains by TLD
        • Detecting Silent cmd.exe Execution With Redirected STDERR & STDOUT
        • Detecting Low Prevalence DLL Loaded From Process In User Downloads Directory
        • Detecting Virtual Drive Mounted From Archive
        • Identify Execution of Script From User's Downloads Folder
        • Identify Potential RDP Tunneled Sessions
        • Identify Instances of PowerShell Invoke-WebRequest, IWR or Net.WebClient
        • Identify Processes Launched by PowerShell Remoting (WSMProvHost.exe)
        • Detect DeviceNetworkEvents for LOLBAS with Download or Upload Functions
        • Detect Execution of PSEXESVC via Remote Systems
        • Identify Suspicious String in Service Creation ImagePath
        • Identify File with Double Extensions
        • Detect Potential Cleartext Credentials in Commandline
        • Detect When Large Number of Files Downloaded From OneDrive or SharePoint
        • Identify and Investigate Phishing Attacks with KQL
      • PowerShell for SecOps
        • Powershell Remoting
        • Reconnaissance Discovery
        • Initial Access Discovery
        • Execution Discovery
        • Persistence Discovery
        • Privilege Escalation Discovery
        • Defence Evasion Discovery
        • Credential Access Discovery
        • Discovery
        • Lateral Movement Discovery
        • Collection Discovery
        • Command & Control (C2) Discovery
        • Exfiltration Discovery
        • Impact Discovery
      • Packet Analysis (pcap)
        • Tcpdump
        • Tcpdump (Intermediate)
        • Tshark
        • Ngrep
      • Investigating Suspicious Emails Using KQL
    • Intermediate and Advanced Skills
      • Investigate Using MITRE ATT&CK Methodology
        • Reconnaissance (TA0043) Techniques
        • Resource Development (TA0042) Techniques
        • Initial Access (TA0001) Techniques
        • Command Execution (TA0002) Techniques
        • Persistence (TA0003) Techniques
        • Privilege Escalation (TA0004) Techniques
        • Defence Evasion (TA0005) Techniques
        • Credential Access (TA0006) Techniques
        • Discovery (TA0007) Techniques
        • Lateral Movement (TA0008) Techniques
        • Collection (TA0009) Techniques
        • Command and Control (C2) (TA0011) Techniques
        • Exfiltration (TA0010) Techniques
        • Impact (TA0040) Techniques
    • Vulnerability Management
    • Malware Analysis
  • DFIR
    • Incident Response
      • Incident Triage
        • Triage Types and Processes
        • PowerShell for Detection and Analysis
          • Malware or Compromise Investigation
          • Lateral Movement Discovery
        • Registry Analysis
        • Sysinternals Intrusion Analysis
        • PowerShell Intrusion Analysis
        • Velociraptor Intrusion Analysis
        • Zimmerman Tools Intrusion Analysis
      • KAPE Artifacts Analysis
      • Velociraptor Artifacts Analysis
      • Using The Unified Kill Chain Model to Analyse Individual Cyber Attacks
        • Phase 1 - Gaining an Initial Foothold
          • Gaining Access to the Network
          • Establishing a Foothold
          • Network Discovery
      • Response Strategies
        • Privilege Escalation Assessment
        • Command and Control Assessment
        • Command Execution Assessment
        • Defence Evasion Assessment
        • Detection Assessment
        • Discovery Assessment
        • Exfiltration Assessment
        • Initial Access Assessment
        • Initial Impact Assessment Techniques
        • Lateral Movement Assessment
        • Persistence Assessment
    • Windows Forensics
      • Evidence of Execution
      • Window Artifact Analysis
        • Account Usage
        • User Activity Tracking (Event Logs)
        • Program Execution
        • File and Folder Opening
        • File Download
        • Browser Usage
        • Deleted File or File Knowledge
        • External Device & USB Usage
    • Linux Forensics
      • Linux Commandline Basics
      • Host Compromise Assessment
    • KQL for Defender & Sentinel
      • MDO (Office)
      • MDI (Identity)
      • MDE (Endpoint)
    • Memory Forensics
      • Memory Forensics (Volatility 3)
    • Playbooks
      • First Responder DFIR Playbook
        • Device Isolation
        • Evidence Collection
          • Acquire Triage Image Using KAPE
          • Acquire Triage Data Using Velociraptor
          • Acquire Triage Data Using Powershell
          • Acquire Triage Memory Image
          • Acquire Image Using FTK
          • AXIOM Cyber Data Collection
        • Windows Forensic Artefacts
          • Application Execution
          • File & Folder Knowledge
          • External Device Usage
          • Network Activity
          • Windows Event Logs
        • Initial Analysis
          • Memory Analysis (Vol 3)
          • Axiom Cyber Examiner
  • Detection Engineering
    • AD Attack Detections & Mitigations
      • Kerberoasting
      • Authentication Server Response (AS-REP) Roasting
      • Password Spraying
      • MachineAccountQuota Compromise
      • Unconstrained Delegation
      • Password in Group Policy Preferences (GPP) Compromise
      • Active Directory Certificate Services (AD CS) Compromise
      • Golden Certificate
      • DCSync
      • Dumping ntds.dit
      • Golden Ticket
      • Silver Ticket
      • Golden Security Assertion Markup Language (SAML)
      • Microsoft Entra Connect Compromise
      • One-way Domain Trust Bypass
      • Security Identifier (SID) History Compromise
      • Skeleton Key
      • Active Directory Security Controls
      • Active Directory Events for Detecting Compromise
    • Attack Triage Playbooks (KQL Triage)
      • Windows Malware Detection Playbook
      • Linux Host Intrusion Detection Playbook (CLI)
      • Linux Intrusion Detection Playbook
      • Large-Scale Compromise Detection Playbook
      • Ransomware Detection Playbook
      • Phishing Email Compromise Detection Playbook
      • Scam Detection Playbook
      • Customer Phishing Detection Playbook
      • Insider Abuse Detection Playbook
      • Information Leakage Detection Playbook
      • Social Engineering Detection Playbook
      • Malicious Network Behaviour Detection Playbook
      • Windows Intrusion Detection Playbook
      • Vulnerability Detection Playbook
      • Business Email Compromise Detection Playbook
    • Process Execution (KQL Triage)
    • Threat Hunting
      • Hunting Ransomware Indicators
      • Hunting With KQL
        • Detecting Malware Infection (MITRE ATT&CK: T1566, T1059)
        • Discovery Activities (MITRE ATT&CK: T1016, T1083, T1046)
        • Credential Theft (MITRE ATT&CK: T1003, T1078)
        • Lateral Movement (MITRE ATT&CK: T1076, T1021)
        • Data Theft (MITRE ATT&CK: T1041, T1071)
        • Detecting CommandLine Executions (MITRE ATT&CK: T1059)
        • Windows Security Logs (Identity and Logon Activities)
      • Hunting With Splunk
Powered by GitBook
On this page
Edit on GitHub

Welcome to RootGuard!

This site is intended to be a hub for DFIR-related skills and knowledge sharing, primarily providing support and guidance for beginners and those looking to enter the field; however, whether you are a seasoned professional or simply curious about cyber defensive operations, the objective is to offer some help.

In today’s fast-paced digital world, you need access to quality cybersecurity resources to stay ahead. Cyber threats evolve quickly, so keeping your knowledge current and skills sharp is essential for protecting systems and data. Here, you’ll find resources to help build your foundational skills, master advanced techniques, and stay up to date with the latest trends, tools, and best practices—the core capabilities needed to tackle challenges and boost your security knowledge.

Starting out in cybersecurity can feel overwhelming. You’re faced with a considerable amount of information and a complex field that spans multiple specialised areas, and the industry moves so fast that it’s hard to keep pace. Many training programs focus on theory, leaving you short on the practical experience employers often want. On top of that, the cost of certifications and courses can hold you back.

The Aim

Our objective is to help other professionals develop their skills by sharing insights that may help improve their skillsets to better safeguard digital resources. The threat landscape constantly evolves; therefore, we must continuously upgrade our awareness and skills of attacker techniques and tactics. There is a constant demand for people with competent cybersecurity skills. However, it takes many years to reach a decent level of competence, a path with many challenges, such as access to resources, opportunities to gain real-world hands-on experience, and the cost of certification. Nonetheless, compared to a decade ago, today, training resources are more freely available (YouTube). However, despite the abundance of resources, there is still a shortage in the cybersecurity workforce and a challenge to land that first job.

While the material provided will be helpful at various levels, a considerable portion is focused on helping beginners and junior professionals develop their careers. The intention is to do this by sharing our expertise and insights and providing practical and actionable resources.

Explore the resources, test the tools mentioned, integrate them into your operational workflows, and share them with other professionals if suitable.

There is no silver bullet other than putting in the work; push yourself as no one else will do it for you. Cybersecurity, in whatever discipline or path you take, is a challenging but worthwhile career choice. There are lots of good people who will help you get there, and I will introduce you to other professionals' incredible work and ask you to check out and support them.

What to Expect!

  • Insights: Stay updated on the latest trends, tools, and technologies for managing and responding to cybersecurity incidents.

  • Sharing of Practical Knowledge: Explore detailed guides and walkthroughs to enhance your skills in threat analysis and system defence.

  • Learning: Share ideas and contribute to a growing community of cybersecurity enthusiasts and professionals.

  • Helping Junior and Entry-Level Security Analysts: Provide actionable insights to help aid development.

Jump Right In

Have a look around, dive into the resources, and join us in strengthening the cybersecurity community!

Last updated 3 months ago

  • Welcome to RootGuard!
  • The Aim
  • What to Expect!
  • Jump Right In
  1. Welcome

RootGuard

NextWho Am I?
Page cover image