My InfoSec journey led me to create my own incident response tools, what .....

Michael Gough walks through the career path that led him to write his own incident response utilities. He starts with an early batch-file script for checking trojans at a bank, then covers consulting work, benchmark projects, and a detour into family law reform that he says sharpened his public speaking. Later stops include a gaming-industry engagement against a persistent intrusion group, where commercial endpoint tools missed in-memory malware and file-system snapshots left blind spots.

The middle of the talk covers the tools that grew out of those failures. Standalone, dependency-free local utilities were built to collect artifacts from hosts and feed them into a SIEM, and a static file analyzer was added for triaging suspicious binaries. He describes testing endpoint products against malware samples and finding that many missed them, and he explains how a Windows firewall rule could silence an endpoint agent. He also argues that properly configured Windows logging gave far more useful detail than endpoint tooling, and that logs can rule out false leads as well as confirm intrusions.

He closes with practical guidance for anyone building tools: keep dependencies minimal, think about how analysts will read the output, since CSV and JSON formats matter, map findings to MITRE ATT&CK, and document and share your work. The overall message is to turn your own problem-solving into reusable tools or write-ups that others can build on.