Chase B.

GIAC-certified Incident Handler (GCIH) and Forensic Examiner (GCFE) with a track record of investigating 6,000+ security incidents across 350,000+ enterprise endpoints. When you are dealing with an active data breach, a hacked Microsoft 365 tenant, suspected employee data theft, or a noisy SIEM that needs tuning, you don't have time for guesswork. As the principal consultant behind VesperDryft Solutions, I provide immediate threat containment, court-defensible digital forensics, and production-grade SOC engineering. I work with three primary groups of clients: 1. BUSINESS OWNERS & EXECUTIVES (Active Breaches, Ransomware & Hacked Accounts) If your business is locked out of systems, dealing with wire fraud, or recovering from an attack, I step in immediately to stop the bleeding and get you back online safely. • Business Email Compromise (BEC): Investigating hacked Microsoft 365 (M365) and Google Workspace accounts, tracing unauthorized access, removing hidden inbox forwarding rules, and revoking stolen session tokens. • Ransomware & Server Recovery: Isolating infected workstations and Linux/Windows servers, identifying how the attacker got in, eradicating hidden persistence mechanisms, and safely restoring operations. • Post-Breach Hardening & Compliance: Delivering clear, plain-English Root Cause Analysis (RCA) reports required for cyber insurance claims, client notifications, and HIPAA / PCI-DSS compliance. 2. HR, LEGAL COUNSEL & LEADERSHIP (Confidential Internal Investigations) When you suspect an insider threat, a departing employee taking client lists, or corporate policy violations, you need hard evidence that holds up under legal scrutiny. • Employee Activity & Data Theft Tracking: Proving whether sensitive files were opened, copied to USB drives, uploaded to personal cloud storage, or exfiltrated before an employee resigned or was terminated. • Forensic Imaging & Chain of Custody: Guiding your local IT staff on proper dead-box or live remote evidence collection (bit-by-bit disk imaging, memory capture, and cloud log preservation) without tipping off the subject or altering timestamps. • Defensible Forensic Reporting: Translating complex digital artifacts into clear, timeline-driven investigative reports that executives, HR, and legal counsel can immediately act on. 3. IT DIRECTORS, MSPs & SECURITY TEAMS (Tier-3 DFIR & SOC Engineering) When your internal IT team or MSP hits an incident beyond daily administration—or you need to build out threat detection from scratch—I act as your on-demand Tier-3 DFIR analyst and Detection Engineer. • Cloud, Identity & Active Directory Forensics: Uncovering lateral movement, privilege escalation, Pass-the-Hash, Kerberoasting, and Golden Ticket attacks across Windows Server, Active Directory, Entra ID (Azure AD), and AWS/Azure environments. • SIEM & EDR Deployment and Tuning: Designing, deploying, and writing custom detection rules for Wazuh, Velociraptor, Microsoft Defender XDR / Sentinel, and Palo Alto Cortex XSIAM/XDR. • Deep-Dive Host & Network Triage: Rapid triage and timeline reconstruction using KAPE, Magnet AXIOM, Autopsy, Eric Zimmerman's forensic suite (MFT, USN Journal, Registry, Prefetch, SRUM, LNK/Jump Lists, EvtxECmd), Hindsight (Chromium/browser forensics), and BloodHound. WHY WORK WITH ME: • Enterprise Scale: I actively defend networks spanning 350,000+ endpoints and have triaged over 6,000 real-world alerts and incidents. • Industry Credibility: GIAC Certified Incident Handler (GCIH), GIAC Certified Forensic Examiner (GCFE), SANS Advisory Board Member, and cybersecurity conference speaker. • Zero Fluff: You won't get a 200-page automated vulnerability scanner dump. You get direct communication, manual threat hunting, verified evidence, and an actionable remediation plan. Dealing with an active incident? Send me a message with "URGENT" in the first line—I prioritize emergency containment and triage requests. Looking to investigates an internal matter or deploy Wazuh/Velociraptor across your endpoints? Let's schedule a quick call to scope your environment.