afterimg: research on digital forensics, detection engineering, and EDR

Detection engineering, DFIR, and whatever else I can't stop digging into.

What remains after the attacker leaves.

afterimg is my research notebook. Most of what lands here will be about detection engineering and digital forensics and incident response, written up with the evidence and the reasoning, not just the conclusion.

• Detection engineeringBuilding, testing, and tuning detections, and being honest about where they break.
• DFIRWindows artifacts, investigations, and what the evidence can and can't tell you.
• Rabbit holesEDR internals, Windows internals, and anything else in security that fascinates me.