encrypted per platform guidelines · password available to recruiters on request
Multi-host Splunk and memory-forensics investigation tracing a phished finance workstation through DLL sideloading and in-memory Metasploit to a WinRM pivot, an AD CS DC-impersonation certificate, and a signatureless Microsoft Graph calendar dead-drop C2.
// incorrect password
scroll = zoom · drag = pan · double-click = toggle · esc = close