| description | Practical cybersecurity investigation, detection and defensive engineering | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| cover | .gitbook/assets/RootGuardLandingPage.png | ||||||||||||||||||||||||||||
| coverY | 0 | ||||||||||||||||||||||||||||
| layout |
|
Security operations. Detection engineering. Digital forensics.
RootGuard is an independent technical reference for security practitioners investigating incidents, developing detections and strengthening defensive environments. Start with a task, follow the evidence, and use the linked procedures as a starting point for your own authorised environment.
| I need to… | Go to |
|---|---|
| Investigate phishing, ransomware, credential theft or lateral movement | Operational incident playbooks |
| Collect and interpret Windows endpoint evidence | DFIR field guides |
| Build or review an AD or identity detection | Detection engineering |
| Understand a technique or forensic artefact | Digital forensics and incident response |
| Study a topic systematically | Learning paths |
| Find contributor standards and review status | Documentation standards |
- Phishing compromise: trace email delivery, user activity, endpoint evidence and account exposure.
- Ransomware response: scope encryption, attack paths, backup impact and controlled recovery.
- Credential theft: examine sign-ins, changes to credentials, permissions and sessions.
- Lateral movement: correlate logons, processes and remote administration.
1. Check the prerequisites. Identify the product and query execution environment, the required audit settings, retention and permissions.
2. Investigate, then corroborate. A matching event is an observation, not a finding of compromise. Correlate multiple sources and document limitations.
3. Control operational changes. Containment and eradication require appropriate authorisation, evidence preservation and post-action checks.
4. Verify validation status. Many examples are conceptual or have undergone static safety review only. They are not presented as production-certified detections.
See the runbook validation framework before relying on operational scripts.
RootGuard maintains separate operational playbooks, technical references and optional practical exercises. The primary purpose is to support real defensive investigations, not to present fictional datasets as operational tooling.
Start Here · About the Author · Contributing and technical standards