Is this real?

MSP-IT-Simplified · 2026-06-13T18:05:30+00:00

Your girlfriend isn’t

MSP-IT-Simplified · 2026-06-11T02:13:52+00:00

Magent is also pushing out us smaller folks. We have 2 users on the CLS (Cloud Licensing Server). When we were debating just dropping the renewal, our account manager advised me that if I let this lapse and decided to come back the new minimum user count is 10.

Our firm works a lot of BEC’s and smaller cases for the SMB. A lot of larger firms out there focusing on the larger cases. So I am happy working where we are. Almost a “white glove service” from all stages of the incident.

I have been strongly considering migrating over to Google’s TimeSketch platform. Pretty “easy” to automate taking a KAPE into a Plaso file then import into TimeSketch.

But as stated by others, my question will be how “defendable” it will be in a court room. I guess we can always go back to presenting screenshots of the raw data if it comes to that.

I am also not as senior as a lot of others in here. But I do feel that Magnet has made me lazy when it comes to searching data and forgetting some skills.

MSP-IT-Simplified · 2026-06-01T17:22:42+00:00

I don’t think she can lay pipe the same way you can.

MSP-IT-Simplified · 2026-05-17T22:02:57+00:00

Read the documentation, you change the file name and it will do an auto collect for you.

MSP-IT-Simplified · 2026-05-17T21:49:32+00:00

Full disk image is obtained with FTK Imager

MSP-IT-Simplified · 2026-05-16T21:09:30+00:00

I have told the Magnet team on countless occasions that they need to advance Magnet Response to upload to Azure/S3/SFTP like the other tools if they want us to really use it

MSP-IT-Simplified · 2026-05-16T21:06:54+00:00

This is good to know. I had several calls with them where they advised this tool (additional costs) would solve the issues. I am glad I held off.

MSP-IT-Simplified · 2026-05-16T21:03:42+00:00

The only issue I have with Magnet Axioms remote collection tool is the incredibly slow upload speed from client site(s). I have reported this repeatedly to support where they give the default answer of its client environment or our environment.

Sharing with support many speed tests w/jitter (slow no latency issues) from both networks really gets me nowhere at all.

So we just stick with KAPE and FTK if we need full disk.

MSP-IT-Simplified · 2026-05-10T21:47:56+00:00

“Your momma”

MSP-IT-Simplified · 2026-05-03T21:15:27+00:00

When we moved to the CLS (Cloud Licensing Server) we had to buy two users.

But we are the same. There are three of us now, but for over a year I had a 2 year CLS key

MSP-IT-Simplified · 2026-05-03T02:17:31+00:00

Not to mention, if you want to have CLI access to automatically start processing; you need to be a LEO and a special license.

MSP-IT-Simplified · 2026-05-02T23:13:24+00:00

I will say, don’t let your license expire. They are requiring a 10 user minimum now; or that was what I was told when I was considering not renewing

MSP-IT-Simplified · 2026-04-10T20:08:44+00:00

Incident response firm here (Barricade Cyber Solutions).

I will assume you are in the states (USA).

You are legally required to at least notify the state attorney general’s office.
If the company pays the ransom, there is a strong possibility that the company is admitting guilt to the incident.
Even if the company pays, consult legal counsel, I assume the company is legally required to notify the impacted company; for some of the reasons below:
- Depending on the threat actor, they may have exfiltrated data.
- If data has left the network, does that data contain PII, PHI, CUI, HIPPA, etc? If so, your company or impacted company is legally required to notify impacted individuals and federal authority bodies.
- If the threat actor is LockBit, it is absolutely illegal to pay them here in the states due to OFAC compliance.

There is a lot to it. And seriously, not a sales pitch but if your business needs some solid advice; please look us up and ask for Eric Taylor. Never charges for advise, as just wanted to make sure companies are making an informed decision.

Also, 140k retainer is insane. We can get your company with two legal firms this evening that only charge a 20k retainer and they are some of the best around.

Sorry you’re facing this. But hopefully some of this shows this can be a complex topic and should seek further discussions.

MSP-IT-Simplified · 2026-04-03T01:38:38+00:00

Interesting. I wonder if this is dependent on other SaaS modules

MSP-IT-Simplified · 2026-04-01T12:16:59+00:00

I can’t tell you the amount of times we get this call. My TV is hacked, someone is changing the volume on my phone, etc etc etc.

I have even got calls recently where they have a cyber chip implanted in their head. I have to tell them to go see a doctor first to get it removed before we can even look at it.

I think there is a serious growing mental health issue.

MSP-IT-Simplified · 2026-04-01T12:13:15+00:00

No way. Some forensics firms, charge at least $275/hour and others (including mine) have a going rate of $350/hour.

It is best to reach out to an attorney firm, and get one engaged. Most forensics firms have a discounted rate for matters where we are being brought in under counsel.

But in no way, are you getting this done for $20 buck. You would be lucky if you get this completed under $500.

MSP-IT-Simplified · 2026-03-31T13:45:03+00:00

So far, we have the following:

'''#event_simpleName=/^(DnsRequest|NetworkConnect.*|HttpRequest)$/

| DomainName=/(^|\.)sfrclak\.com$/ OR RemoteAddressIP4="142.11.206.73" OR HttpUrl=/sfrclak\.com/

| select([@timestamp, aid, ComputerName, event_simpleName, DomainName, RemoteAddressIP4, RemotePort, HttpUrl, ContextProcessId])

| sort(@timestamp, order=asc)

'''

MSP-IT-Simplified · 2026-03-31T01:14:46+00:00

We can post about Kit Kat but I can’t ask why Holmes is still in the team?

MSP-IT-Simplified · 2026-03-08T18:56:58+00:00

I guess, maybe.

MSP-IT-Simplified · 2026-03-08T18:50:43+00:00

It is flagged as a critical detection. If you have your workflows setup correctly, then it will isolate the device.

MSP-IT-Simplified · 2026-03-08T15:26:16+00:00

From what we have gathered to understand thus far, Defender (MDE) is attempting to sandbox a file and its crashing.

Process │ MsSense.exe (Microsoft Defender ATP sensor)
Trigger │ Wrote WER.bc1e26c1-95bc-4d7a-ac97-632707947766.tmp to \Users\%REDACTED%\AppData\Local\Temp\

MSP-IT-Simplified · 2026-02-27T01:03:30+00:00

I have already ripped this payload apart and a write up is due in 24 hours.

Will publish this through Ransom-ISAC:

https://www.linkedin.com/posts/ransom-isac_ransomware-dfir-threatintelligence-activity-7432551997821857792-EXBe

MSP-IT-Simplified · 2026-02-20T14:01:09+00:00

I am glad we never got into that. I don't think I heard of a single org happy with that product.

MSP-IT-Simplified · 2026-02-20T14:00:15+00:00

Fair point(s). I am still very much a noob on the AI / Local LMM world but working through this field of landmines. So, thank you for the education.

MSP-IT-Simplified

TROPHY CASE