FROM THE SOC

Field notes from the NightWatch team.

Postmortems, threat intelligence, defense-in-depth notes, and the occasional rant from the engineers who pick up the phone.

Filter by tag: edr (2) ransomware (2) xedr (1) defense-in-depth (1) nis2 (1) compliance (1) regulation (1) sme (1) postmortem (1) lateral-movement (1) Clear filter

postmortem

FEATURED

postmortem ransomware lateral-movement edr

Postmortem: how a Word document became Domain Admin

Anonymized field report from a real incident we handled in February. Initial access via macro, persistence in 4 minutes, full domain compromise in 47. Defenses that mattered, defenses that didn't.

18 February 2026 Learn more →