tktkkame

Security engineer learning from the ground up. This blog is how I grow: notes and articles adapted from my Japanese book on server defense.

Japan Joined on Oct 16, 2026 https://zenn.dev/tokotokokame

tktkkame

Nov 6

Windows persistence collapses to a few places: audit first, then diff

#security #windows #sysmon #incidentresponse

2 min read

Want to connect with tktkkame?

Create an account to connect with tktkkame. You can also sign in below to proceed if you already have an account.

Create Account

Already have an account? Sign in

tktkkame

Nov 5

One host hit port 445 on many others at 2 a.m.: the pre-lateral knock

#security #windows #networking #incidentresponse

2 min read

tktkkame

Nov 4

C2 beacons give themselves away by the clock

#security #networking #zeek #incidentresponse

2 min read

tktkkame

Nov 3

Golden and Silver Tickets are caught by logs that should exist

#security #windows #kerberos #activedirectory

2 min read

tktkkame

Nov 2

DNS always gets through, so attackers hid data in it

#security #dns #networking #incidentresponse

2 min read

tktkkame

Nov 2

Ten thousand failed logins matter less than one success

#security #linux #ssh #incidentresponse

2 min read

tktkkame

Oct 30

AD attacks hide in normal logs: the tell is the encryption type (RC4)

#security #windows #activedirectory #kerberos

1 min read

tktkkame

Oct 29

One account without MFA lost an AWS account in 13 minutes

#security #aws #cloudtrail #incidentresponse

1 min read

tktkkame

Oct 28

The night a domain controller replicated every password (Event 4662)

#security #windows #activedirectory #incidentresponse

1 min read

tktkkame

Oct 27

Deleted is evidence: what attackers cannot erase, in 7 principles

#security #forensics #incidentresponse #linux

2 min read

tktkkame

Oct 26

Opening a Word file got lsass read. Remember 0x1410.

#security #windows #sysmon #incidentresponse

2 min read

tktkkame

Oct 26

The attacker deleted everything. At 2 a.m., /proc still remembered.

#security #linux #forensics #incidentresponse

5 min read

tktkkame

Oct 23

Log wipers get caught by the sound of the wipe

#security #linux #windows #incidentresponse

2 min read

tktkkame

Oct 22

SSH that skipped the bastion was lateral movement confessing

#security #linux #ssh #networksecurity

2 min read

tktkkame

Oct 21

A file backdated to 2018 with touch, caught by one line

#security #linux #forensics #incidentresponse

2 min read

tktkkame

Oct 21

One SSH key, one cron line: a 5-minute persistence audit

#security #linux #ssh #incidentresponse

2 min read

DEV Community

tktkkame

Badges

Writing Debut

GitHub Repositories

Currently learning

Currently hacking on

Windows persistence collapses to a few places: audit first, then diff

Want to connect with tktkkame?

One host hit port 445 on many others at 2 a.m.: the pre-lateral knock

C2 beacons give themselves away by the clock

Golden and Silver Tickets are caught by logs that should exist

DNS always gets through, so attackers hid data in it

Ten thousand failed logins matter less than one success

AD attacks hide in normal logs: the tell is the encryption type (RC4)

One account without MFA lost an AWS account in 13 minutes

The night a domain controller replicated every password (Event 4662)

Deleted is evidence: what attackers cannot erase, in 7 principles

Opening a Word file got lsass read. Remember 0x1410.

The attacker deleted everything. At 2 a.m., /proc still remembered.

Log wipers get caught by the sound of the wipe

SSH that skipped the bastion was lateral movement confessing

A file backdated to 2018 with touch, caught by one line

One SSH key, one cron line: a 5-minute persistence audit