CONSULTING — INCIDENT RESPONSE

Digital Forensics &
Incident Response

End-to-end incident response and forensic investigation across Windows, Active Directory, Azure, and Microsoft 365. Led by a practitioner with hundreds of enterprise-grade investigations completed inside Microsoft's global CIRT.

+

Enterprise Investigations

+

Years DFIR Experience

+

Years DFIR Experience

CIRT

Microsoft Global Team

ENGAGEMENT TRIGGERS

When to call us

Incident response is time-critical. These are the situations where organizations engage Hashmu — reactively when a threat is active, and proactively before one materializes.

Active ransomware or breach

Systems are encrypted, credentials are compromised, or unauthorized access is confirmed. You need immediate containment and a clear picture of what happened.

Suspicious activity detected

Alerts are firing but your team lacks the bandwidth or experience to determine scope and severity. You need a structured investigation, not guesswork.

Compromised credentials or insider threat

An account has been taken over, data has been exfiltrated, or you suspect malicious insider activity. Identity forensics and log analysis are required.

Regulatory or legal investigation

A breach requires formal documentation, evidence preservation, and a defensible forensic report for regulators, legal counsel, or insurers.

Proactive IR readiness assessment

You want to validate your IR plan, test your detection and response capability, and understand your gaps before an incident forces the question.

Cloud or Microsoft 365 compromise

Azure tenants, Exchange Online, SharePoint, or Teams have been accessed by an unauthorized party. Cloud forensics requires a different approach than on-premises investigation.

SCOPE OF WORK

What the engagement covers

Each engagement is scoped to your environment and incident type. These are the core investigation and response capabilities we bring to every engagement.

01 Windows & Active Directory Forensics

Deep investigation of Windows endpoints and Active Directory environments — event log analysis, lateral movement tracing, persistence mechanism identification, and attacker timeline reconstruction.

01 Windows & Active Directory Forensics

Deep investigation of Windows endpoints and Active Directory environments — event log analysis, lateral movement tracing, persistence mechanism identification, and attacker timeline reconstruction.

02 Cloud & Microsoft 365 Investigation

Forensic investigation of Azure, Entra ID, Exchange Online, SharePoint, and Teams environments. Unified audit log analysis, OAuth app review, and cloud-native attacker technique identification.

02 Cloud & Microsoft 365 Investigation

Forensic investigation of Azure, Entra ID, Exchange Online, SharePoint, and Teams environments. Unified audit log analysis, OAuth app review, and cloud-native attacker technique identification.

03 Ransomware Triage & Recovery

Rapid identification of the initial access vector, encryption scope, and lateral spread path. Containment guidance, decryption assessment, and a phased recovery plan to restore operations with minimal data loss.

03 Ransomware Triage & Recovery

04 Malware Analysis & Persistence Review

Static and behavioral analysis of malicious artifacts found during investigation. Identification of attacker-installed backdoors, scheduled tasks, registry modifications, and other persistence mechanisms.

04 Malware Analysis & Persistence Review

05 Breach Containment & Remediation

Structured containment actions to stop active attacker access — account resets, network isolation, conditional access enforcement, and MDE response actions — executed with minimal operational disruption.

05 Breach Containment & Remediation

06 Post-Incident Report & Remediation Roadmap

A complete forensic report documenting root cause, attacker timeline, affected systems, and evidence chain. Includes a prioritized remediation roadmap with short, medium, and long-term security improvements.

06 Post-Incident Report & Remediation Roadmap

OUR APPROACH

How an engagement runs

A structured, methodical process — from first contact through final report. No improvisation, no scope creep.

OUR APPROACH

How an engagement runs

A structured, methodical process — from first contact through final report. No improvisation, no scope creep.

How an engagement runs

A structured, methodical process — from first contact through final report. No improvisation, no scope creep.

Initial triage call

Within hours of first contact, we conduct a structured triage call to understand what you're seeing, what systems are affected, and what access we need.

Evidence collection & preservation

We collect relevant forensic artifacts — memory dumps, disk images, log exports, cloud audit logs — using forensically sound methods that preserve evidentiary integrity.

Investigation & attacker timeline reconstruction

We reconstruct exactly what happened: initial access vector, persistence mechanisms, lateral movement paths, data accessed or exfiltrated, and the full attacker timeline.

Containment & active threat removal

With a clear picture of attacker access, we execute targeted containment — removing persistence, rotating credentials, applying conditional access policies, and isolating affected systems.

Final report & strategic debrief

We deliver a full incident report covering findings, root cause, attacker techniques (mapped to MITRE ATT&CK), and a prioritised remediation roadmap.

OUR APPROACH

How an engagement runs

A structured, methodical process — from first contact through final report. No improvisation, no scope creep.

How an engagement runs

A structured, methodical process — from first contact through final report. No improvisation, no scope creep.

Initial triage call

Within hours of first contact, we conduct a structured triage call to understand what you're seeing, what systems are affected, and what access we need.

Evidence collection & preservation

We collect relevant forensic artifacts — memory dumps, disk images, log exports, cloud audit logs — using forensically sound methods that preserve evidentiary integrity.

Investigation & attacker timeline reconstruction

We reconstruct exactly what happened: initial access vector, persistence mechanisms, lateral movement paths, data accessed or exfiltrated, and the full attacker timeline.

Containment & active threat removal

With a clear picture of attacker access, we execute targeted containment — removing persistence, rotating credentials, applying conditional access policies, and isolating affected systems.

Final report & strategic debrief

We deliver a full incident report covering findings, root cause, attacker techniques (mapped to MITRE ATT&CK), and a prioritised remediation roadmap.

GET IN TOUCH

Facing an active incident?

Response time matters. Get in touch directly and we will respond within hours — not days.

Book an emergency call

View all consulting services

Digital Forensics & Incident Response

Digital Forensics & Incident Response

+

+

+

CIRT

CIRT

When to call us

When to call us

When to call us

Active ransomware or breach

Suspicious activity detected

Compromised credentials or insider threat

Regulatory or legal investigation

Proactive IR readiness assessment

Cloud or Microsoft 365 compromise

What the engagement covers

What the engagement covers

What the engagement covers

01

Windows & Active Directory Forensics

01

Windows & Active Directory Forensics

02

Cloud & Microsoft 365 Investigation

02

Cloud & Microsoft 365 Investigation

03

Ransomware Triage & Recovery

03

Ransomware Triage & Recovery

04

Malware Analysis & Persistence Review

04

Malware Analysis & Persistence Review

05

Breach Containment & Remediation

05

Breach Containment & Remediation

06

Post-Incident Report & Remediation Roadmap

06

Post-Incident Report & Remediation Roadmap

How an engagement runs

How an engagement runs

How an engagement runs

Initial triage call

Evidence collection & preservation

Investigation & attacker timeline reconstruction

Containment & active threat removal

Final report & strategic debrief

How an engagement runs

How an engagement runs

Initial triage call

Evidence collection & preservation

Investigation & attacker timeline reconstruction

Containment & active threat removal

Final report & strategic debrief

Facing an active incident?

Facing an active incident?

Digital Forensics &
Incident Response

Digital Forensics &
Incident Response