home / incident-response
Incident Response Case Studies
Anonymised incident timelines, my role, the actions taken and the post-incident improvements.
What each case contains
Timeline
What happened and when, with times relative to detection (T+0) so an incident cannot be matched to a public event.
My role
What I was responsible for, and who else was involved.
Actions taken
Containment, eradication and recovery decisions, and the reasoning behind each.
Improvements
What changed afterwards in people, process and tooling, so the same incident is harder to repeat.
Case studies
newest firstOAuth Consent Phishing to Cloud Data Access
A single consent grant becomes mailbox access, cloud credential theft, new persistence and an exfiltration attempt. Full timeline, decisions, containment and improvements.
02 · supply chain · highCI Token Exposure and a Tampered Build Artifact
A leaked pipeline token is used to publish a build that does not match its source. Detection, containment, recovery and what changed.
03 · identity and access · mediumIAM Analyst at a Web Design Company
My work as IAM Analyst running the joiner, mover, leaver lifecycle across a web design company: onboarding, role changes and clean offboarding.
04 · security operations · mediumSOC Analyst at a Web Design Agency
My work as SOC Analyst at the same web design agency: monitoring, alert triage, escalation and the tuning that followed.
Anonymisation
Cases are anonymised before publication: organisations, people, systems and locations are generalised, indicators and identifiers are removed, and nothing is published that could help re-identify the affected party. The full rules are in the sanitization policy.