analyst@lab:~$ find ./research -type f
Controlled experiments that connect offensive techniques with process telemetry, forensic evidence, detection opportunities and practical mitigations.
Research archive
Each entry separates the technique, the controlled methodology, the observed evidence and the current validation status.
Windows Security / security research
A controlled SCF-file lab for testing remote icon-triggered NTLM authentication, separating legacy Chrome behavior from current Windows exposure and defensive telemetry.
Windows Security / security research
A validated Windows lab showing how MpCmdRun.exe reveals a Defender-excluded directory through a distinctive skipped-scan response, with detection and mitigation guidance.
Windows Security / security research
A practical Windows forensics blueprint for inspecting Zone.Identifier metadata, tracing download origins, testing Unblock behavior and monitoring MOTW creation.
Red Team Operations / red team operations
A validated red-team lab combining Sliver staging with a custom Netsh Helper DLL, event-triggered persistence and Microsoft Defender detection analysis.
Network & Windows Security / detection engineering
A controlled lab that stores a harmless PowerShell instruction in DNS TXT, retrieves and validates it from Windows, then studies DNS, process and script telemetry.
Windows Security / detection engineering
A controlled Windows research lab that builds a benign LNK–HTA polyglot, studies its execution chain, maps forensic telemetry and tests safe Startup persistence.
Lab standard
Research blueprints and completed experiments are clearly distinguished. Uncollected results are never presented as facts.
Potentially dangerous techniques are scoped to non-destructive validation inside isolated, authorized environments.
Process ancestry, host events, file artifacts, ATT&CK mapping and mitigations are documented alongside execution.