DOSSIERS · METHOD, NOT ANECDOTE
Each dossier walks through a complete investigation over synthetic data: the evidence I cited, the reasoning, the alternatives I ruled out, the decision with its confidence, and the detection I built — with its measured numbers. You can reproduce it yourself.
Synthetic cases for educational purposes. They show method and judgement; they are not real telemetry and do not certify protection.
No dossier matches that search.
Dossier 1
What evidence turns a temporal coincidence into a case worth investigating?
A synthetic Microsoft Graph record shows an interactive sign-in from a location other than the usual one. Three minutes later, a synthetic Exchange record shows the creation of a mailbox rule that forwards mail to an external domain. The account owner does not recognize that rule and asks to preserve the evidence.
Dossier 2
When does the name of a process or a path stop being enough to judge an alert?
Two independent scenarios from the detection bench: a PowerShell process with an encoded command launched under an Office macro, and the creation of a scheduled task pointing to a public write folder. Both share the same underlying problem: the most visible indicator also appears in legitimate activity within the same set.