Posts tagged "incident-response"
- Investigating a real incident with the Amcache: walkthrough
A fictional but realistic ransomware investigation, walked through the Amcache evidence end to end: the SHA-1 pivot, the corroboration, and the limits of the hive.
2026-05-27