// Archive

Research notes

DFIR & Incident Response

Windows Processes Investigation

smss.exe It’s called Session Manager. Session 0 starts csrss.exe and wininit.exe (OS services) while Session 1 starts csrss.exe and winlogon.exe (User session).…
READ ARTICLE ↗
Governance, Risk & Compliance

Dumping RDP Credentials

Administrators typically use Remote Desktop Protocol (RDP) in order to manage Windows environments remotely. It is also typical RDP to be enabled…
READ ARTICLE ↗