From 3afad083fdea1ae04c112cfb22c37ce0aa9b21d2 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:36:00 +0100 Subject: [PATCH 01/25] docs: replace em dashes with straightforward prose --- start-here/README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/start-here/README.md b/start-here/README.md index 31b654c..d3f8b6c 100644 --- a/start-here/README.md +++ b/start-here/README.md @@ -25,13 +25,13 @@ ## Content labels -**Operational playbook** — step-by-step investigative workflow with decision gates and response criteria. +**Operational playbook**, step-by-step investigative workflow with decision gates and response criteria. -**Technical reference** — focused explanation of a technique, artefact, query or platform. +**Technical reference**, focused explanation of a technique, artefact, query or platform. -**Practical exercise** — optional synthetic training material, never evidence from a real incident. +**Practical exercise**, optional synthetic training material, never evidence from a real incident. -**Validation status** — technical claims may be subject to static review, syntax testing, lab verification or production validation. Follow the label on each document. +**Validation status**, technical claims may be subject to static review, syntax testing, lab verification or production validation. Follow the label on each document. For command and query testing, use the [Runbook Execution and Validation Matrix](../defensive-security/dfir/runbooks/runbook-execution-validation-matrix.md). From 58de018d8a2b3f0201c714c1a29bce9863a6eb59 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:36:04 +0100 Subject: [PATCH 02/25] docs: replace em dashes with straightforward prose --- defensive-security/dfir/field-guides/windows-endpoint-triage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defensive-security/dfir/field-guides/windows-endpoint-triage.md b/defensive-security/dfir/field-guides/windows-endpoint-triage.md index d5ec11f..b1e92fa 100644 --- a/defensive-security/dfir/field-guides/windows-endpoint-triage.md +++ b/defensive-security/dfir/field-guides/windows-endpoint-triage.md @@ -2,7 +2,7 @@ > **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. -**Reviewed:** 20 October 2026 +**Reviewed:** 20 October 2026 **Status:** Methodology reference; commands must be validated and authorised locally. ## Initial decisions From a7982948e194fab46d7d14b8c1620144f72a6c99 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:36:08 +0100 Subject: [PATCH 03/25] docs: replace em dashes with straightforward prose --- .../dfir/end-to-end-playbooks/phishing-compromise.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md b/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md index 0e5b137..829f984 100644 --- a/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md +++ b/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md @@ -2,7 +2,7 @@ > **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. -**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. +**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. > **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing. @@ -15,7 +15,7 @@ 4. Preserve relevant logs, incident exports and endpoint artefacts through approved tools. Track collection time, retention gaps and custody. 5. Keep **observations**, **hypotheses** and **confirmed conclusions** in separate notes. -**Technology coverage:** Defender for Office 365, Defender XDR, Entra ID, Exchange Online +**Technology coverage:** Defender for Office 365, Defender XDR, Entra ID, Exchange Online **Trigger:** malicious email, user click, credential submission, mailbox change or suspicious endpoint execution. ## 2. Confirm telemetry prerequisites @@ -31,7 +31,7 @@ EmailEvents | where Timestamp > ago(7d) | where RecipientEmailAddress =~ TargetMailbox | project Timestamp, NetworkMessageId, RecipientEmailAddress, - SenderFromAddress, Subject, DeliveryAction, ThreatTypes + SenderFromAddress, Subject, DeliveryAction, ThreatTypes | order by Timestamp desc ``` @@ -58,7 +58,7 @@ DeviceProcessEvents | where Timestamp > ago(48h) and DeviceName =~ Host | where InitiatingProcessFileName in~ ("winword.exe","excel.exe","outlook.exe","msedge.exe") | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, - InitiatingProcessFileName, InitiatingProcessCommandLine, SHA1 + InitiatingProcessFileName, InitiatingProcessCommandLine, SHA1 | order by Timestamp desc ``` From 46d4d68d590995484a0bec3fe10cb014bfd05cfd Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:36:11 +0100 Subject: [PATCH 04/25] docs: replace em dashes with straightforward prose --- .../dfir/end-to-end-playbooks/ransomware.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/defensive-security/dfir/end-to-end-playbooks/ransomware.md b/defensive-security/dfir/end-to-end-playbooks/ransomware.md index 3a6ddb7..22627f6 100644 --- a/defensive-security/dfir/end-to-end-playbooks/ransomware.md +++ b/defensive-security/dfir/end-to-end-playbooks/ransomware.md @@ -2,7 +2,7 @@ > **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. -**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. +**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. > **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing. @@ -15,7 +15,7 @@ 4. Preserve relevant logs, incident exports and endpoint artefacts through approved tools. Track collection time, retention gaps and custody. 5. Keep **observations**, **hypotheses** and **confirmed conclusions** in separate notes. -**Technology coverage:** Defender for Endpoint, Windows/AD, backup systems, network controls +**Technology coverage:** Defender for Endpoint, Windows/AD, backup systems, network controls **Trigger:** mass file modification, ransom note, backup tampering, encryption or extortion claim. ## 2. Confirm telemetry prerequisites @@ -30,7 +30,7 @@ DeviceProcessEvents | where Timestamp > ago(24h) | where ProcessCommandLine has_any ("vssadmin","wbadmin","bcdedit") | project Timestamp, DeviceName, AccountName, FileName, - ProcessCommandLine, InitiatingProcessFileName, SHA1, ReportId + ProcessCommandLine, InitiatingProcessFileName, SHA1, ReportId | order by Timestamp desc ``` @@ -44,8 +44,8 @@ let Host = "REPLACE_WITH_DEVICE_NAME"; DeviceFileEvents | where Timestamp > ago(24h) and DeviceName =~ Host | summarize FileEvents=count(), DistinctPaths=dcount(FolderPath), - Samples=make_set(FileName, 12) - by bin(Timestamp, 15m), InitiatingProcessFileName + Samples=make_set(FileName, 12) + by bin(Timestamp, 15m), InitiatingProcessFileName | order by Timestamp desc ``` @@ -59,7 +59,7 @@ let Host = "REPLACE_WITH_DEVICE_NAME"; DeviceNetworkEvents | where Timestamp > ago(24h) and DeviceName =~ Host | project Timestamp, DeviceName, InitiatingProcessFileName, - RemoteIP, RemotePort, RemoteUrl, ActionType + RemoteIP, RemotePort, RemoteUrl, ActionType | order by Timestamp desc ``` From aabd658559e32bc9e29098e94afab400a7efd3d3 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:36:15 +0100 Subject: [PATCH 05/25] docs: replace em dashes with straightforward prose --- .../dfir/end-to-end-playbooks/credential-theft.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/defensive-security/dfir/end-to-end-playbooks/credential-theft.md b/defensive-security/dfir/end-to-end-playbooks/credential-theft.md index bbe89ba..077c55f 100644 --- a/defensive-security/dfir/end-to-end-playbooks/credential-theft.md +++ b/defensive-security/dfir/end-to-end-playbooks/credential-theft.md @@ -2,7 +2,7 @@ > **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. -**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. +**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. > **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing. @@ -15,7 +15,7 @@ 4. Preserve relevant logs, incident exports and endpoint artefacts through approved tools. Track collection time, retention gaps and custody. 5. Keep **observations**, **hypotheses** and **confirmed conclusions** in separate notes. -**Technology coverage:** Microsoft Entra, Defender XDR, Windows AD, workload identities +**Technology coverage:** Microsoft Entra, Defender XDR, Windows AD, workload identities **Trigger:** suspicious authentication, token exposure, credential addition, role change or endpoint credential-access alert. ## 2. Confirm telemetry prerequisites @@ -30,7 +30,7 @@ let User = "analyst@example.invalid"; SigninLogs | where TimeGenerated > ago(72h) and UserPrincipalName =~ User | project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, - ResultType, ConditionalAccessStatus, CorrelationId + ResultType, ConditionalAccessStatus, CorrelationId | order by TimeGenerated desc ``` @@ -57,7 +57,7 @@ DeviceProcessEvents | where Timestamp > ago(72h) | where ProcessCommandLine has_any ("lsass","comsvcs.dll","procdump") | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, - InitiatingProcessFileName, SHA1 + InitiatingProcessFileName, SHA1 | order by Timestamp desc ``` From 17b0c1b32213cebcf5674b0475d31bba8ebef4f9 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:36:18 +0100 Subject: [PATCH 06/25] docs: replace em dashes with straightforward prose --- .../dfir/end-to-end-playbooks/lateral-movement.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md b/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md index f78f23f..d024d7c 100644 --- a/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md +++ b/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md @@ -2,7 +2,7 @@ > **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. -**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. +**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. > **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing. @@ -15,7 +15,7 @@ 4. Preserve relevant logs, incident exports and endpoint artefacts through approved tools. Track collection time, retention gaps and custody. 5. Keep **observations**, **hypotheses** and **confirmed conclusions** in separate notes. -**Technology coverage:** Defender for Endpoint, Windows Security/System, AD, network and change records +**Technology coverage:** Defender for Endpoint, Windows Security/System, AD, network and change records **Trigger:** unexpected remote administrative activity, privileged logon, remote service/task or cross-host execution. ## 2. Confirm telemetry prerequisites @@ -29,9 +29,9 @@ Check table availability, licences, audit policy, retention, time synchronisatio DeviceProcessEvents | where Timestamp > ago(48h) | where FileName in~ ("psexec.exe","wmic.exe","winrs.exe","mstsc.exe") - or ProcessCommandLine has_any ("Invoke-Command","Enter-PSSession") + or ProcessCommandLine has_any ("Invoke-Command","Enter-PSSession") | project Timestamp, DeviceName, AccountName, FileName, - ProcessCommandLine, InitiatingProcessFileName, ReportId + ProcessCommandLine, InitiatingProcessFileName, ReportId | order by Timestamp desc ``` @@ -45,7 +45,7 @@ DeviceLogonEvents | where Timestamp > ago(48h) | where LogonType in~ ("Network","RemoteInteractive") | project Timestamp, DeviceName, AccountName, LogonType, - RemoteIP, ActionType, FailureReason + RemoteIP, ActionType, FailureReason | order by Timestamp desc ``` @@ -59,7 +59,7 @@ DeviceNetworkEvents | where Timestamp > ago(48h) | where RemotePort in (135,139,445,3389,5985,5986) | project Timestamp, DeviceName, InitiatingProcessFileName, - RemoteIP, RemotePort, ActionType + RemoteIP, RemotePort, ActionType | order by Timestamp desc ``` From 47bfa8077d85e6e076462cd8dac58ca78cdd4fe4 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:36:21 +0100 Subject: [PATCH 07/25] docs: replace em dashes with straightforward prose --- .../ad-detections-and-mitigations/golden-ticket.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-ticket.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-ticket.md index b6a00e4..a4c8e5c 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-ticket.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-ticket.md @@ -2,8 +2,8 @@ > **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. -**ATT&CK:** [T1558.001](https://attack.mitre.org/techniques/T1558/001/) -**Reviewed:** 20 October 2026 +**ATT&CK:** [T1558.001](https://attack.mitre.org/techniques/T1558/001/) +**Reviewed:** 20 October 2026 **Validation:** Concept / unvalidated; verify all fields and behaviour in an authorised lab. ## Threat overview @@ -31,13 +31,13 @@ SecurityEvent | where TimeGenerated > ago(24h) | where EventID == 4769 | extend Requester = tostring(Account), - Service = tostring(ServiceName), - SourceAddress = tostring(IpAddress) + Service = tostring(ServiceName), + SourceAddress = tostring(IpAddress) | where isnotempty(Requester) | summarize Requests=count(), DistinctServices=dcount(Service), - Services=make_set(Service, 30), - Sources=make_set(SourceAddress, 20) - by Requester, bin(TimeGenerated, 1h) + Services=make_set(Service, 30), + Sources=make_set(SourceAddress, 20) + by Requester, bin(TimeGenerated, 1h) | order by DistinctServices desc, Requests desc ``` From 757b42b03a76079fe60d8dff41ed6445bad3db2c Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:36:25 +0100 Subject: [PATCH 08/25] docs: replace em dashes with straightforward prose --- .../ad-detections-and-mitigations/silver-ticket.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/silver-ticket.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/silver-ticket.md index 7ab56b6..e8b9348 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/silver-ticket.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/silver-ticket.md @@ -1,7 +1,7 @@ # Silver Ticket: Detection and Response -**ATT&CK:** [T1558.002](https://attack.mitre.org/techniques/T1558/002/) -**Reviewed:** 20 October 2026 +**ATT&CK:** [T1558.002](https://attack.mitre.org/techniques/T1558/002/) +**Reviewed:** 20 October 2026 **Validation:** Concept / unvalidated; verify on representative services. ## Threat overview @@ -30,10 +30,10 @@ SecurityEvent | where EventID == 4624 | where AuthenticationPackageName =~ "Kerberos" | extend AccountName = tostring(Account), - SourceAddress = tostring(IpAddress) + SourceAddress = tostring(IpAddress) | summarize Logons=count(), Accounts=make_set(AccountName, 30), - Sources=make_set(SourceAddress, 20) - by Computer, LogonType, bin(TimeGenerated, 1h) + Sources=make_set(SourceAddress, 20) + by Computer, LogonType, bin(TimeGenerated, 1h) | order by Logons desc ``` From 5316d321263c7af06a37bd8047d55ba0bf18bb3e Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:36:29 +0100 Subject: [PATCH 09/25] docs: replace em dashes with straightforward prose --- .../ad-detections-and-mitigations/kerberoasting.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/kerberoasting.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/kerberoasting.md index 52f3b2c..16b2db0 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/kerberoasting.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/kerberoasting.md @@ -2,8 +2,8 @@ > **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. -**ATT&CK:** [T1558.003](https://attack.mitre.org/techniques/T1558/003/) -**Review date:** 20 October 2026 +**ATT&CK:** [T1558.003](https://attack.mitre.org/techniques/T1558/003/) +**Review date:** 20 October 2026 **Validation:** Concept / unvalidated; domain-controller telemetry must be confirmed. ## Threat overview @@ -28,13 +28,13 @@ SecurityEvent | where TimeGenerated > ago(24h) | where EventID == 4769 | extend RequestingAccount = tostring(Account), - ClientAddress = tostring(IpAddress), - TargetService = tostring(ServiceName) + ClientAddress = tostring(IpAddress), + TargetService = tostring(ServiceName) | where isnotempty(RequestingAccount) and isnotempty(TargetService) | summarize Requests=count(), - Services=dcount(TargetService), - TargetServices=make_set(TargetService, 30) - by RequestingAccount, ClientAddress, WindowStart=bin(TimeGenerated, 15m) + Services=dcount(TargetService), + TargetServices=make_set(TargetService, 30) + by RequestingAccount, ClientAddress, WindowStart=bin(TimeGenerated, 15m) | where Services >= 5 | order by Services desc, Requests desc ``` From d0ad01f6779052c0752470113799e19ecbba901e Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:36:58 +0100 Subject: [PATCH 10/25] docs: remove repetitive banners and prefer direct operational language --- .../dfir/end-to-end-playbooks/phishing-compromise.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md b/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md index 829f984..2434b0e 100644 --- a/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md +++ b/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md @@ -1,7 +1,5 @@ # Phishing Compromise: Operational Incident Investigation Playbook -> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. - **Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. From ca0a91fd8a9bfb11c9764d564789eebf5f8629ba Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:37:02 +0100 Subject: [PATCH 11/25] docs: remove repetitive banners and prefer direct operational language --- defensive-security/dfir/end-to-end-playbooks/ransomware.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/defensive-security/dfir/end-to-end-playbooks/ransomware.md b/defensive-security/dfir/end-to-end-playbooks/ransomware.md index 22627f6..2df1532 100644 --- a/defensive-security/dfir/end-to-end-playbooks/ransomware.md +++ b/defensive-security/dfir/end-to-end-playbooks/ransomware.md @@ -1,7 +1,5 @@ # Ransomware: Operational Incident Investigation Playbook -> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. - **Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. From 9f98501869ea56e58502863a0c69bcabb3424628 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:37:06 +0100 Subject: [PATCH 12/25] docs: remove repetitive banners and prefer direct operational language --- .../dfir/end-to-end-playbooks/credential-theft.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/defensive-security/dfir/end-to-end-playbooks/credential-theft.md b/defensive-security/dfir/end-to-end-playbooks/credential-theft.md index 077c55f..d781e3c 100644 --- a/defensive-security/dfir/end-to-end-playbooks/credential-theft.md +++ b/defensive-security/dfir/end-to-end-playbooks/credential-theft.md @@ -1,7 +1,5 @@ # Credential Theft: Operational Incident Investigation Playbook -> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. - **Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. From 14a61478b9aec1f6bc8ce791a69de7d554188a4a Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:37:09 +0100 Subject: [PATCH 13/25] docs: remove repetitive banners and prefer direct operational language --- .../dfir/end-to-end-playbooks/lateral-movement.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md b/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md index d024d7c..922783d 100644 --- a/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md +++ b/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md @@ -1,7 +1,5 @@ # Lateral Movement: Operational Incident Investigation Playbook -> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. - **Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. From 177616483a77fc9057945355a96258bb4b6ec16f Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:37:24 +0100 Subject: [PATCH 14/25] docs: remove generic status banner and editorial em dashes --- defensive-security/dfir/field-guides/windows-endpoint-triage.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/defensive-security/dfir/field-guides/windows-endpoint-triage.md b/defensive-security/dfir/field-guides/windows-endpoint-triage.md index b1e92fa..c040abc 100644 --- a/defensive-security/dfir/field-guides/windows-endpoint-triage.md +++ b/defensive-security/dfir/field-guides/windows-endpoint-triage.md @@ -1,7 +1,5 @@ # Windows Endpoint Triage: First-Response Field Guide -> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. - **Reviewed:** 20 October 2026 **Status:** Methodology reference; commands must be validated and authorised locally. From 1ffcddc0a0b579f93b183889a83870c8b60011d8 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:37:26 +0100 Subject: [PATCH 15/25] docs: remove generic status banner and editorial em dashes --- .../dfir/field-guides/evidence-acquisition-and-integrity.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/defensive-security/dfir/field-guides/evidence-acquisition-and-integrity.md b/defensive-security/dfir/field-guides/evidence-acquisition-and-integrity.md index 01d0488..c1639d3 100644 --- a/defensive-security/dfir/field-guides/evidence-acquisition-and-integrity.md +++ b/defensive-security/dfir/field-guides/evidence-acquisition-and-integrity.md @@ -1,7 +1,5 @@ # Evidence Acquisition and Integrity -> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. - **Status:** Procedure template requiring organisational approval and tool-specific validation. ## Before acquisition From 45d9fb700da50326ab56b6d593e811000bdec75d Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:37:30 +0100 Subject: [PATCH 16/25] docs: remove generic status banner and editorial em dashes --- .../dfir/field-guides/windows-artifact-interpretation.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/defensive-security/dfir/field-guides/windows-artifact-interpretation.md b/defensive-security/dfir/field-guides/windows-artifact-interpretation.md index 6098b2f..660eabe 100644 --- a/defensive-security/dfir/field-guides/windows-artifact-interpretation.md +++ b/defensive-security/dfir/field-guides/windows-artifact-interpretation.md @@ -1,7 +1,5 @@ # Windows Forensic Artefacts: Interpretation Reference -> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. - **Status:** Technical reference; artefact meaning and location depend on Windows build and configuration. | Artefact | What it may help establish | Important limitation | From 3c73ca5e4b5651725b531cce60de7ad4ff97f977 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:37:33 +0100 Subject: [PATCH 17/25] docs: remove generic status banner and editorial em dashes --- .../ad-detections-and-mitigations/kerberoasting.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/kerberoasting.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/kerberoasting.md index 16b2db0..50e58b2 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/kerberoasting.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/kerberoasting.md @@ -1,7 +1,5 @@ # Kerberoasting: Detection and Investigation -> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. - **ATT&CK:** [T1558.003](https://attack.mitre.org/techniques/T1558/003/) **Review date:** 20 October 2026 **Validation:** Concept / unvalidated; domain-controller telemetry must be confirmed. From 8728f263ab6f65c2893510a668538236101a9b76 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:37:53 +0100 Subject: [PATCH 18/25] docs: simplify detection guide language and remove redundant banners --- .../ad-detections-and-mitigations/password-spraying.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/password-spraying.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/password-spraying.md index 4186ee4..30dce26 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/password-spraying.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/password-spraying.md @@ -1,7 +1,5 @@ # Password Spraying: Detection and Investigation -> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. - **ATT&CK:** [T1110.003](https://attack.mitre.org/techniques/T1110/003/) **Review date:** 20 October 2026 **Validation:** Concept / unvalidated; verify with your environment's telemetry. From 34f8a6c32a5ad02d913e6bb01a976694dbd25e58 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:37:56 +0100 Subject: [PATCH 19/25] docs: simplify detection guide language and remove redundant banners --- .../ad-detections-and-mitigations/golden-ticket.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-ticket.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-ticket.md index a4c8e5c..ff5e6ed 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-ticket.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-ticket.md @@ -1,7 +1,5 @@ # Golden Ticket: Detection and Response -> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready. - **ATT&CK:** [T1558.001](https://attack.mitre.org/techniques/T1558/001/) **Reviewed:** 20 October 2026 **Validation:** Concept / unvalidated; verify all fields and behaviour in an authorised lab. From e0747dbd7b748dbb4f4e1b5e445e8afb7b58ab0e Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:37:59 +0100 Subject: [PATCH 20/25] docs: simplify detection guide language and remove redundant banners --- .../ad-detections-and-mitigations/dcsync.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/dcsync.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/dcsync.md index 8c0a470..4d0a40e 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/dcsync.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/dcsync.md @@ -11,9 +11,9 @@ DCSync (MITRE ATT&CK T1003.006) abuses Active Directory Directory Replication Se - Collect Windows Security Event **4662** from domain controllers and configure the necessary Directory Service Access auditing and directory object SACLs. Event 4662 is not automatically generated for every DCSync attempt. - Inspect actual `SecurityEvent` records and their `Properties` and `AccessMask` contents. Schema and event rendering vary by agent and collection method. - Relevant replication extended-right GUIDs include: - - `1131f6aa-9c07-11d1-f79f-00c04fc2dcd2` — DS-Replication-Get-Changes - - `1131f6ad-9c07-11d1-f79f-00c04fc2dcd2` — DS-Replication-Get-Changes-All - - `89e95b76-444d-4c62-991a-0facbeda640c` — DS-Replication-Get-Changes-In-Filtered-Set + - `1131f6aa-9c07-11d1-f79f-00c04fc2dcd2` , DS-Replication-Get-Changes + - `1131f6ad-9c07-11d1-f79f-00c04fc2dcd2` , DS-Replication-Get-Changes-All + - `89e95b76-444d-4c62-991a-0facbeda640c` , DS-Replication-Get-Changes-In-Filtered-Set Event 4662 reports object operations on the domain controller. It does **not** reliably give the network originator's IP address. Neither Event 4672 nor ordinary LDAP connections alone prove DCSync activity. From 8e79cab8689ab846759263234daf72fbdd813610 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:38:16 +0100 Subject: [PATCH 21/25] docs: establish plain-English editorial guidance for public RootGuard content --- contributing/README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/contributing/README.md b/contributing/README.md index 7b87bfe..b63fb28 100644 --- a/contributing/README.md +++ b/contributing/README.md @@ -4,6 +4,19 @@ Follow the [RootGuard Documentation Design System](../design-system/README.md) f [Technical Content Review Register](content-review-register.md) tracks prioritised legacy corrections and validation status. +## Writing in plain English + +RootGuard is a public technical reference, not an internal status report or marketing brochure. + +- Write for a practising analyst or engineer. State the task, prerequisites, procedure, expected observations and limitations without promotional introductions. +- Use direct verbs such as **inspect**, **query**, **compare**, **preserve**, **verify** and **escalate**. +- Avoid em dashes in prose. Prefer a full stop, colon, semicolon or a rewritten sentence. +- Avoid stock phrases such as *ever-evolving threat landscape*, *cutting-edge*, *seamlessly*, *game changer*, *unlock the power of*, *delve into* and *robust solution*. Replace them with a specific claim or remove them. +- Do not repeat generic warning banners on every page. Put important requirements next to the relevant command or decision. +- Do not describe examples as comprehensive, complete, validated or production-ready unless the article provides evidence for that claim. +- Preserve literal syntax in KQL, PowerShell, command output, quoted source material and URLs. Language cleanup must never alter executable logic. +- Read the final article aloud. Remove filler, repeated ideas and unnecessary adjectives. + ## Publishing principles - Prefer evidence-based guidance, clear prerequisites and explicit limitations over unsupported claims. From a5ee5c08a16575a1ec99663387dae697ae425355 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:38:34 +0100 Subject: [PATCH 22/25] ci: add plain-language check for new Markdown content --- scripts/check_editorial.py | 51 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 scripts/check_editorial.py diff --git a/scripts/check_editorial.py b/scripts/check_editorial.py new file mode 100644 index 0000000..3264d3b --- /dev/null +++ b/scripts/check_editorial.py @@ -0,0 +1,51 @@ +#!/usr/bin/env python3 +"""Review newly added public Markdown prose for em dashes and stock phrases. + +Use with: python scripts/check_editorial.py --base origin/master +The check reads only added lines in the git diff. Existing legacy prose remains +a separate, tracked editorial backlog. Code blocks are ignored in whole-file mode. +""" +import argparse +import pathlib +import re +import subprocess +import sys + +PHRASES = [ + "ever-evolving threat landscape", "cutting-edge", "game changer", + "unlock the power of", "delve into", "seamlessly integrate", + "in today's digital landscape", +] +PATTERN = re.compile("|".join(re.escape(p) for p in PHRASES), re.IGNORECASE) + +def main(): + parser = argparse.ArgumentParser() + parser.add_argument("--base", default="HEAD^") + args = parser.parse_args() + diff = subprocess.run( + ["git", "diff", "--unified=0", args.base, "HEAD", "--", "*.md"], + capture_output=True, text=True, check=True, + ).stdout + path = "" + issues = [] + for line in diff.splitlines(): + if line.startswith("+++ b/"): + path = line[6:] + elif line.startswith("+") and not line.startswith("+++"): + added = line[1:] + # Skip likely code, tables of technical syntax, or URL lines. + if added.lstrip().startswith((" ", "`", "http", "#!")): + continue + found = PATTERN.search(added) + if "—" in added or found: + issues.append((path, added[:180])) + for path, excerpt in issues: + print(f"Editorial review required: {path}: {excerpt}") + if issues: + print("Remove em dashes or stock language from newly added prose.") + return 1 + print("New Markdown prose editorial checks passed.") + return 0 + +if __name__ == "__main__": + sys.exit(main()) From cd66b60c100028262d9b795238be69df47f1e6b9 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:38:50 +0100 Subject: [PATCH 23/25] ci: enforce plain-language check on new Markdown prose --- .github/workflows/docs-quality.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml index 598e841..4828d0b 100644 --- a/.github/workflows/docs-quality.yml +++ b/.github/workflows/docs-quality.yml @@ -5,6 +5,7 @@ on: paths: - '**/*.md' - 'scripts/check_docs.py' + - 'scripts/check_editorial.py' - 'practice-labs/case-studies/**' - '.github/workflows/docs-quality.yml' push: @@ -26,6 +27,8 @@ jobs: - uses: actions/setup-python@v5 with: python-version: '3.12' + - name: Check added prose for editorial style + run: python scripts/check_editorial.py --base HEAD^ - name: Validate internal Markdown links run: python scripts/check_docs.py - name: Validate synthetic case study datasets From b2ef76c26d166f8047f2939be397ae727b1b561e Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:39:11 +0100 Subject: [PATCH 24/25] ci: exempt quoted editorial examples in writing standards --- scripts/check_editorial.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/check_editorial.py b/scripts/check_editorial.py index 3264d3b..8b267af 100644 --- a/scripts/check_editorial.py +++ b/scripts/check_editorial.py @@ -32,6 +32,8 @@ def main(): if line.startswith("+++ b/"): path = line[6:] elif line.startswith("+") and not line.startswith("+++"): + if path == "contributing/README.md": + continue added = line[1:] # Skip likely code, tables of technical syntax, or URL lines. if added.lstrip().startswith((" ", "`", "http", "#!")): From 0afdfdaa2d766ab4efa69002e076cabe713d4e8f Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 19:40:14 +0100 Subject: [PATCH 25/25] ci: fetch sufficient history for editorial diff check --- .github/workflows/docs-quality.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml index 4828d0b..53daa9f 100644 --- a/.github/workflows/docs-quality.yml +++ b/.github/workflows/docs-quality.yml @@ -24,6 +24,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + with: + fetch-depth: 0 - uses: actions/setup-python@v5 with: python-version: '3.12'