#blueteam

I Tracked an Attacker Who Typed 'ls' on a Windows Server

Hunting through 955,000 log events to reconstruct a ransomware attack from first scan to last encrypted file