Topic
dfir
8 posts
- ToolsNov 2026 · 8 min
INSITO 1.0.0 — open-source recovery for the Rhysida ESXi locker
INSITO is a free, open-source (MIT) single-binary recovery tool for the Rhysida ESXi ransomware locker. No ransom, no attacker keys, no internet access required. Built on the published Rhysida research and extended to the ESXi locker.
- Case StudyOct 2026 · 22 min
One Workflow Input: From a Pipeline Dispatch to Cloud Administrator
A poisoned record in a client portal reached a GitHub Actions input that was expanded straight into shell. The pipeline's own one-hour cloud session left the runner 160 times; five days later the attacker held administrator rights and every production database was staged for export under their key. The full sequence, the evidence, and the controls that break it.
- ToolsAug 2026 · 15 min
IONSEC TRACE: Leave No Model Untraced — Open-Source Forensics for the AI Harness
IONSEC TRACE is an open-source, forensically sound collector and analyzer for AI harness evidence — now 52 collectors, a Python CLI and a Go binary with near-identical capabilities, a 103-rule secret detector, and conversation secret hunting.
- ArticleAug 2026 · 30 min
The Machine Has No Disk: Forensic Readiness for AI Agent Runtimes
Forensic readiness for AI agent runtimes — Cloudflare Computer, NVIDIA OpenShell, and the collapse of the endpoint as an evidence source.
- ArticleJul 2026 · 15 min
Coercion to krbtgt: NTLM Relay and ADCS ESC8 in 2026
A full ESC8 walkthrough against a lab domain, then the forensic reconstruction — why the certificate serial, not the source IP, is the artifact that ties the whole chain together.
- ToolsAug 2025 · 2 min
MAES: The M365 Analyzer & Extractor Suite
At IONSEC, we’re excited to introduce MAES: The M365 Analyzer & Extractor Suite — an open-source platform purpose-built to simplify and accelerate Microsoft 365 (M365) forensic investigations.
- ToolsAug 2025 · 3 min
DO Audit Log Scraper v2.0
The DO Audit Log Scraper is a Chrome/Chromium extension that enables forensic-grade audit log extraction.
- ToolsAug 2025 · 2 min
Forti-DFIR: Open-Source Framework for Fortinet Forensics & Incident Response
At IONSEC, we’re proud to introduce Forti-DFIR — an open-source initiative created to give security teams the tools they need for forensic investigations and incident response in Fortinet environments.