NexurAI
50 practical, no-fluff guides on detection engineering, SOC triage, threat hunting, cloud, DFIR and AI security. Free to read - then practice what you learn in the labs.
6 guides
Windows logs are a firehose. Here are the specific Event IDs that actually matter for detection and DFIR - logons, process creation, services and log tampering.
Read guideWhen it's already on fire, a repeatable process keeps you fast and calm. Here's the NIST / SANS PICERL incident-response lifecycle, stage by stage.
Read guideSome malware never touches disk. Memory forensics recovers what's only in RAM - injected code, hidden processes, network connections. Here's the workflow.
Read guideA web shell is attacker code planted in your web root for remote command execution. Here's how they get in, and the high-fidelity ways to catch them.
Read guidePersistence is how malware survives a reboot. Learn the most common Windows persistence spots - Run keys, services, scheduled tasks, WMI - and how to find them.
Read guideWith the KRBTGT hash, an attacker forges Kerberos tickets and owns the domain invisibly. Learn how Golden/Silver tickets work and how defenders respond.
Read guide