About HammerCrafted Security

Hello and Welcome! 


My name is Bryan Hammer and HammerCrafted Security is a personal space for breaking down real world detection and investigative security problems as they actually show up in day to day work.


This site is built around observations, patterns, and lessons learned from hands on investigations, not theory, vendor promises, or checklist driven security. The focus is on understanding behavior, surrounding context, and how small signals often point to larger stories when you widen the lens.


Here you’ll find thoughts on detection design, identity and authentication analysis, living off the land activity, and investigative decision making. The goal is not to tell people what tool to buy or which alert to trust, but to share how security problems look when you’re the one working them and what holds up when the noise gets loud.


HammerCrafted Security exists to share what I’ve learned along the way, for defenders who want clearer thinking, better context, and fewer false assumptions, as well as to help me keep my notes and presentations organized.

HammerCrafted Presentations

The Anatomy of a 4625 Event Code

 This presentation breaks down why failed logon events are rarely just failed logons. Using real investigation patterns, it walks through how authentication telemetry is generated, commonly misinterpreted, and how surrounding context reveals intent that single events miss. The focus is on practical analysis, not alert chasing. 


Developed from real world investigations and internal presentations.


Key themes covered:

  • How Windows authentication events are generated
  • Why single 4625 alerts are misleading
  • Correlating surrounding authentication activity
  • Separating user error from systemic or malicious behavior

Working investigation notes and detection insights

Follow along for updates, talks, and investigation notes

Copyright © 2026 HammerCrafted Security - All Rights Reserved.

Powered by

This website uses cookies.

We use cookies to analyze website traffic and optimize your website experience. By accepting our use of cookies, your data will be aggregated with all other user data.

Accept