
Seoul Metro Credential Spray Replay
Walk through a noisy authentication spike, separate automation from human-driven attempts, and document a defensible timeline for leadership.
Masonry grid, editor strip, and headline search mirror a newsroom archive: you skim, pin, and open only the investigations that match your desk mandate.

Walk through a noisy authentication spike, separate automation from human-driven attempts, and document a defensible timeline for leadership.

Hunt for dormant privileged identities that reappear after control changes, using cloud-native logs without jumping to conclusions.

Practice extracting actionable indicators from extortion language while avoiding melodramatic attribution claims.

Compress a week of reverse-proxy logs into a defendable story about credential stuffing versus misrouted API clients.

Trace a poisoned dependency update through build logs, package hashes, and CI alerts without accusing vendors recklessly.

Evaluate slow data movement that could be research—or theft—using DLP-style clues without vilifying employees.

Turn hyperactive Kubernetes audit streams into prioritized investigation threads for platform and SOC teams.

Reconstruct a business email compromise thread with header forensics, tone shifts, and banking-change validation steps.

Read low-volume OT-adjacent telemetry alongside IT alerts to spot maintenance windows masquerading as incidents.