DFIR: From alert to root cause using Osquery without leaving Elastic Security

This report explains a modern, query-driven DFIR approach using Osquery and Elastic Defend to perform live, fleet-scale forensics and detection; it demonstrates the workflow with a phishing-to-Mimikatz example showing how browser history, file lookups, Shellbags, Shimcache, UserAssist, and Prefetch evidence are used to reconstruct an attack and generate IoCs and detections.