🔏
RootGuard
HomeSOC OperationsIncident ResponseWindows ForensicsLinux ForensicsKQL Investigations
  • Welcome
    • RootGuard
      • Who Am I?
        • Professional Profile
  • Resources Hub
    • Blogs
      • Articles
        • Safeguarding SMEs: The Strategic Importance of a Security Operations Center (SOC)
      • Posts
        • Roadmap to Becoming a Cybersecurity Specialist
        • Starting a Career in Cybersecurity
        • A Guide to Landing Your First Cybersecurity Analyst Role
        • Moving from Intermediate to Expert Incident Responder
  • SOC Operations
    • Introduction
      • Development Resources
        • SOC Analysts Roadmap
        • Becoming A SOC Analyst
        • SOC Analysts Prep Interview Questions
    • Essential Skills
      • Critical Windows EventIDs to Monitor
    • Junior Analyst Skills
      • Splunk Use Cases
      • KQL Use Cases
        • Reconnaissance (TA0043)
        • Initial Access (TA0001)
        • Execution (TA0002)
        • Persistence (TA0003)
        • Privilege Escalation (TA0004)
        • Defence Evasion (TA0005)
        • Credential Access (TA0006)
        • Discovery (TA0007)
        • Lateral Movement (TA0008)
        • Collection (TA0009)
        • Command and Control (TA0011)
        • Exfiltration (TA0010)
        • Impact (TA0040)
      • Investigating Common Attacks
        • Domain Dominance Attacks - Detection & Analysis
        • Investigating a Suspected AD FS Distributed Key Management (DKM) Attack
        • Authentication From Suspicious DeviceName
        • Identifying Interactive or RemoteInteractive Session From Service Account
        • Identifying Split or Part Archive File Transfers
        • Detect Potential Cleartext Credentials in Command Line
        • Detecting Command Line Interpreters Launched via Scheduled Tasks
        • Detecting Files Containing Potentially Sensitive Data
        • Detecting DeviceNetworkEvents From Windows Processes and Domains by TLD
        • Detecting Silent cmd.exe Execution With Redirected STDERR & STDOUT
        • Detecting Low Prevalence DLL Loaded From Process In User Downloads Directory
        • Detecting Virtual Drive Mounted From Archive
        • Identify Execution of Script From User's Downloads Folder
        • Identify Potential RDP Tunneled Sessions
        • Identify Instances of PowerShell Invoke-WebRequest, IWR or Net.WebClient
        • Identify Processes Launched by PowerShell Remoting (WSMProvHost.exe)
        • Detect DeviceNetworkEvents for LOLBAS with Download or Upload Functions
        • Detect Execution of PSEXESVC via Remote Systems
        • Identify Suspicious String in Service Creation ImagePath
        • Identify File with Double Extensions
        • Detect Potential Cleartext Credentials in Commandline
        • Detect When Large Number of Files Downloaded From OneDrive or SharePoint
        • Identify and Investigate Phishing Attacks with KQL
      • PowerShell for SecOps
        • Powershell Remoting
        • Reconnaissance Discovery
        • Initial Access Discovery
        • Execution Discovery
        • Persistence Discovery
        • Privilege Escalation Discovery
        • Defence Evasion Discovery
        • Credential Access Discovery
        • Discovery
        • Lateral Movement Discovery
        • Collection Discovery
        • Command & Control (C2) Discovery
        • Exfiltration Discovery
        • Impact Discovery
      • Packet Analysis (pcap)
        • Tcpdump
        • Tcpdump (Intermediate)
        • Tshark
        • Ngrep
      • Investigating Suspicious Emails Using KQL
    • Intermediate and Advanced Skills
      • Investigate Using MITRE ATT&CK Methodology
        • Reconnaissance (TA0043) Techniques
        • Resource Development (TA0042) Techniques
        • Initial Access (TA0001) Techniques
        • Command Execution (TA0002) Techniques
        • Persistence (TA0003) Techniques
        • Privilege Escalation (TA0004) Techniques
        • Defence Evasion (TA0005) Techniques
        • Credential Access (TA0006) Techniques
        • Discovery (TA0007) Techniques
        • Lateral Movement (TA0008) Techniques
        • Collection (TA0009) Techniques
        • Command and Control (C2) (TA0011) Techniques
        • Exfiltration (TA0010) Techniques
        • Impact (TA0040) Techniques
    • Vulnerability Management
    • Malware Analysis
  • DFIR
    • Incident Response
      • Incident Triage
        • Triage Types and Processes
        • PowerShell for Detection and Analysis
          • Malware or Compromise Investigation
          • Lateral Movement Discovery
        • Registry Analysis
        • Sysinternals Intrusion Analysis
        • PowerShell Intrusion Analysis
        • Velociraptor Intrusion Analysis
        • Zimmerman Tools Intrusion Analysis
      • KAPE Artifacts Analysis
      • Velociraptor Artifacts Analysis
      • Using The Unified Kill Chain Model to Analyse Individual Cyber Attacks
        • Phase 1 - Gaining an Initial Foothold
          • Gaining Access to the Network
          • Establishing a Foothold
          • Network Discovery
      • Response Strategies
        • Privilege Escalation Assessment
        • Command and Control Assessment
        • Command Execution Assessment
        • Defence Evasion Assessment
        • Detection Assessment
        • Discovery Assessment
        • Exfiltration Assessment
        • Initial Access Assessment
        • Initial Impact Assessment Techniques
        • Lateral Movement Assessment
        • Persistence Assessment
    • Windows Forensics
      • Evidence of Execution
      • Window Artifact Analysis
        • Account Usage
        • User Activity Tracking (Event Logs)
        • Program Execution
        • File and Folder Opening
        • File Download
        • Browser Usage
        • Deleted File or File Knowledge
        • External Device & USB Usage
    • Linux Forensics
      • Linux Commandline Basics
      • Host Compromise Assessment
    • KQL for Defender & Sentinel
      • MDO (Office)
      • MDI (Identity)
      • MDE (Endpoint)
    • Memory Forensics
      • Memory Forensics (Volatility 3)
    • Playbooks
      • First Responder DFIR Playbook
        • Device Isolation
        • Evidence Collection
          • Acquire Triage Image Using KAPE
          • Acquire Triage Data Using Velociraptor
          • Acquire Triage Data Using Powershell
          • Acquire Triage Memory Image
          • Acquire Image Using FTK
          • AXIOM Cyber Data Collection
        • Windows Forensic Artefacts
          • Application Execution
          • File & Folder Knowledge
          • External Device Usage
          • Network Activity
          • Windows Event Logs
        • Initial Analysis
          • Memory Analysis (Vol 3)
          • Axiom Cyber Examiner
  • Detection Engineering
    • AD Attack Detections & Mitigations
      • Kerberoasting
      • Authentication Server Response (AS-REP) Roasting
      • Password Spraying
      • MachineAccountQuota Compromise
      • Unconstrained Delegation
      • Password in Group Policy Preferences (GPP) Compromise
      • Active Directory Certificate Services (AD CS) Compromise
      • Golden Certificate
      • DCSync
      • Dumping ntds.dit
      • Golden Ticket
      • Silver Ticket
      • Golden Security Assertion Markup Language (SAML)
      • Microsoft Entra Connect Compromise
      • One-way Domain Trust Bypass
      • Security Identifier (SID) History Compromise
      • Skeleton Key
      • Active Directory Security Controls
      • Active Directory Events for Detecting Compromise
    • Attack Triage Playbooks (KQL Triage)
      • Windows Malware Detection Playbook
      • Linux Host Intrusion Detection Playbook (CLI)
      • Linux Intrusion Detection Playbook
      • Large-Scale Compromise Detection Playbook
      • Ransomware Detection Playbook
      • Phishing Email Compromise Detection Playbook
      • Scam Detection Playbook
      • Customer Phishing Detection Playbook
      • Insider Abuse Detection Playbook
      • Information Leakage Detection Playbook
      • Social Engineering Detection Playbook
      • Malicious Network Behaviour Detection Playbook
      • Windows Intrusion Detection Playbook
      • Vulnerability Detection Playbook
      • Business Email Compromise Detection Playbook
    • Process Execution (KQL Triage)
    • Threat Hunting
      • Hunting Ransomware Indicators
      • Hunting With KQL
        • Detecting Malware Infection (MITRE ATT&CK: T1566, T1059)
        • Discovery Activities (MITRE ATT&CK: T1016, T1083, T1046)
        • Credential Theft (MITRE ATT&CK: T1003, T1078)
        • Lateral Movement (MITRE ATT&CK: T1076, T1021)
        • Data Theft (MITRE ATT&CK: T1041, T1071)
        • Detecting CommandLine Executions (MITRE ATT&CK: T1059)
        • Windows Security Logs (Identity and Logon Activities)
      • Hunting With Splunk
Powered by GitBook
On this page
  • Why should anyone listen to me?
  • Disclaimer
  • Tools and product mentions
  • Can the site content be shared?
  • You can also visit my:
Edit on GitHub
  1. Welcome
  2. RootGuard

Who Am I?

PreviousRootGuardNextProfessional Profile

Last updated 3 months ago

Hi, I'm Adrian Anglin. I'm an Information and Cyber Security Professional interested in offensive and defensive security operations. These days, most of my time is spent doing Digital Forensics, Incident Response, Threat Hunting, and other operational areas within InfoSec. My journey into the tech space started as a Network Engineer, and some years later, I moved into InfoSec. Feel free to checkout my

Over the years, I have studied various areas of information and cybersecurity and earned several degrees and professional certifications. I am a cybersecurity enthusiast at heart and a continuous learner. The reason for setting up this site is to share my experiences and the content of other professionals whose work has been helpful in my development. Thanks to all the other professionals who have shared their expertise and knowledge with the broader community.

My passion and interest in information technology and security go beyond my own employment, and therefore, I wanted to:

  • A place to publish some of my learning outcomes to help others improve their skills, knowledge, and processes relating to information and cybersecurity.

  • Lower the barrier of entry for upcoming security professionals who are interested in entering the field but lack the knowledge and skills.

  • And finally, a place to consolidate and publish some of my achievements and the thought process that led to them.

The aim is to provide some theoretical and practical approaches to help others delve deeper into the more common tools and technology. The content on the site reflects the tools, processes, and methodologies I have used and am familiar with. It's impossible to cover all areas at a level appropriate for everyone, so in the areas of focus, I will reference other online resources that I think may be helpful. On these occasions, I will attribute the appropriate credit and request that you support their work. A significant part of our field is the willingness of others to share their research, knowledge and expertise; let's help them so their work continues.

Why should anyone listen to me?

My area of knowledge isn't focused on a single area within the technology space, nor am I an expert; what I am is a continuous learner and someone who has invested time into my development and has gained a considerable amount of experience working in multiple areas with information technology. In my professional career and spare time, I have undertaken multiple successful technology implementations, achieving the goals based on agreed objectives. As part of the day job, managed day-to-day information and cybersecurity operations and implemented organisational cyber initiatives.

Disclaimer

Unless I am explicitly quoting someone, the thoughts and opinions expressed are my own. This website and content are provided without warranty of any kind.

Tools and product mentions

I use many daily, and any mention of a particular tool, product, or service is of my own accord and is not sponsored unless otherwise stated.

Can the site content be shared?

Most definitely, provided you give attribution.

You can also visit my:

X:

Bluesky:

Professional Profile
LinkedIn
@adriananglin
@andranglin.bsky.social
Page cover image