cover	coverY	coverHeight	layout
.gitbook/assets/RootGuardLandingPage.png	0	236	width cover title description tableOfContents outline pagination metadata default visible size true hero visible true visible visible true visible true visible true visible true

RootGuard

Operational Defence & Incident Response Procedures

Practical. Field-Tested. Enterprise-Ready.

RootGuard serves as a comprehensive field manual for SOC analysts, detection engineers, and incident responders operating in high-threat environments. Moving beyond theoretical certification checklists, this repository focuses on immediate operational utility for active defence scenarios.

We provide high-density, deployment-ready resources: precision KQL queries, forensic artifact breakdowns, and structured playbooks designed to detect, contain, and eradicate sophisticated threats.

Core Objectives

• Identity Security: Mitigation strategies for Active Directory and Entra ID vectors.
• Digital Forensics & IR: Methodologies for surgical breach reconstruction.
• Detection Engineering: Development of high-fidelity alerting logic.

---

Technical Modules

🛡️ Detection Engineering & KQL

High-signal logic for detecting evasion techniques.

• Identity Forgery: Golden/Silver Ticket analysis.
• Credential Attacks: Kerberoasting, AS-REP Roasting, and DCSync detection.
• Lateral Movement: Pass-the-Ticket and Overpass-the-Hash validation.
• Cloud Security: Entra ID compromise and privilege escalation monitoring.
• Scope: Deployable queries optimised for Microsoft Sentinel & Defender.

🔬 Windows Forensics & DFIR

Deep-dive artifact analysis for evidence verification.

• Execution Evidence: Registry analysis (ShimCache, AmCache, UserAssist).
• Timeline Reconstruction: Event Logs, Prefetch, SRUM, and BAM data.
• Attack Patterns: Correlating persistence mechanisms and lateral movement.
• Output: Structured timelines and correlation playbooks.

🩸 Incident Response Playbooks

Lifecycle management from detection to recovery.

• Triage: Rapid assessment protocols.
• Containment: Privilege escalation isolation.
• Recovery: Ransomware response procedures.
• Data Protection: Exfiltration detection and blocking at the wire.

⚔️ Offensive Security for Defenders

Adversary tradecraft analysis for proactive hardening.

• Access Vectors: Credential stuffing, spraying, and brute-force patterns.
• Lateral Movement: Analysis of PsExec, WMI, and WinRM traffic.
• Exploitation: Post-exploitation techniques and "living-off-the-land" binaries.

🕸️ Malware & Network Forensics

Artifact dissection and traffic analysis.

• Static and dynamic malware analysis workflows.
• PCAP investigation using Wireshark and TShark.
• IOC extraction and behavioural hunting rule generation.

---

The RootGuard Standard

Feature	Operational Value
Actionable Utility	Prioritises exact commands, queries, log samples, and execution steps over theory.
Platform Agnostic	Core principles apply universally, supported by deep integration with the Microsoft ecosystem.
Living Intelligence	Continuously updated based on emerging threats and operational feedback.
Defender Centric	Derived from active incident response engagements and real-world breach data.

---

Access the Arsenal

• Detection Engineering: AD Attacks & KQL Triage
• Defensive Security: Windows Forensics & IR Strategies
• Offensive Security: Exploitation & Password Attacks
• Learning Hub: Core Skills & Career Development
• About the Author: Operational Background

---

RootGuard: Elevating the defensive baseline.

Authorised for defensive operations only. Ensure compliance with all applicable legal frameworks and ethical standards.