Slate teams up with Smarties to add candy colors to its EV trucks



When Tristan Brown, an associate professor of history at MIT, first examined a Chinese tea chest label displayed at Old South Meeting House, he had no reason to doubt its story. Descendants of the Boston blacksmith Thomas Wells had donated the label in 1987, saying it had been recovered after colonial protesters threw tea into Boston Harbor in 1773.
But after a year of research, Brown reached a different conclusion: The label was made nearly a century later. The decisive clue came when he read the Chinese text in Cantonese rather than Mandarin, as previous scholars had done. He found that the characters had been used phonetically, in slightly variant forms across contemporary sources, to represent the name of Smith, Archer & Co., a US firm that acquired Asian tea for shipment to American markets during the 1860s and 1870s.

Working with the Wells family, he traced the label to a relative who traveled from Michigan to California during the Gold Rush era before returning and operating a business known as the California Tea Store. Brown argues that claims for its revolutionary pedigree probably developed later, amid the centennial commemorations of the 1870s.
The discovery does not make the label historically insignificant, he says. Instead, what began as an inquiry into a supposed artifact of the Boston Tea Party became a study of how ordinary objects acquire historical authority, and how historical memory itself is made.
“History is never finished,” he says. “Even objects that have sat in museums for decades can reveal entirely new stories when we ask new questions.”
Alissa Totman ’13 was a sophomore when she joined MIT BrainTrust, a student-run organization that connects Institute undergraduates and people with brain injuries for support and socializing. “That group was a great way to learn about the human experience of what people go through when they experience a brain injury,” she says. And it laid the foundation for her life’s work.
Today, Totman is a physician specializing in brain injury medicine at the University of Pittsburgh Medical Center, where she treats adults with head trauma, stroke, brain tumors, and more.
She is also the founder of Synapse, a nonprofit focused on providing support for such individuals. The organization grew out of a group she started with Jaclyn Konopka ’14 during medical school at Stanford, and Totman launched it as a national service organization in 2016, while pursuing her master’s degree in public health at Harvard.
There are now chapters at 28 universities across the country—and Totman still runs the organization. “There’s a big need for more resources like this,” she says.
Read more at www.technologyreview.com/alumni-profiles.
5 min read
Research teams at NASA’s Glenn Research Center are involved in developing theory and software to predict the noise from aircraft engines. This software helps engineers to design and analyze new and improved aircraft propulsion systems. Copies of our software can be requested from NASA’s Software Catalog.
Development of jet noise prediction codes is multifaceted. Since JeNo predicts jet noise using Lilley’s Acoustic Analogy and the mean flow solutions from a Reynolds-Averaged Navier-Stokes (RANS) code, accurate acoustic predictions hinge on accurate aerodynamic predictions. This is why acoustic source modeling and turbulence modeling, together with the development of advanced measurement systems, are the leading areas of research in jet noise prediction at NASA Glenn. RANS-based jet noise prediction schemes based on Lilley’s Acoustic Analogy offer relatively quick answers compared to those from alternative methods like Large-Eddy Simulations (LES) or Direct Numerical Simulation (DNS).
The JeNo jet noise prediction code calculates the far-field sound spectral density produced by axisymmetric jets at a user-specified observer location and frequency range. Currently, JeNo has been validated for subsonic and low supersonic, unheated axisymmetric jets. Copies of the JeNo code can be requested from NASA’s Software Catalog.
Development of the MGBK code preceeded JeNo. Researchers at NASA GRC have used MGBK to predict trends in jet noise for complicated aircraft engine exhaust nozzles. MGBK was used to analyze the noise reduction benefits of chevrons–serrations on teh edge of turbofan nozzles–which are a familiar site on many commercial aircraft engines today. Copies of the MGBK codes can be requested from NASA’s Software Catalog.
Predicated on simplistic models of the fan flow and geometry, V072 has been proven useful in studying rotor/stator interaction tone noise. When you need to design a low-noise fan stage, tone noise level predictions from V072 can help you make smart choices for such important design parameters as blade and vane counts, rotor-stator spacing, and stator vane sweep and lean. When you’re after quick noise estimates early in the design cycle, V072 may be your tool of choice. Copies of V072 can be requested from NASA’s Software Catalog.
Taking rotor/stator interaction noise prediction to the next level, not only can TFaNS calculate the tone noise levels generated by rotor/stator interaction it can also account for the blade row acoustic coupling effects such transmission and reflection and can propagate those tones to the far field. Like V072, TFaNS runs quickly and can be used in early design stages for studying trends. Copies of TFaNS can be requested from NASA’s Software Catalog
When simple models are too simple, an analysis with Linflux gives you the power to study realistic, 3-D flows and blade geometries. Compared with V072 and TFaNS, Linflux requires significantly more computational resources since it models much more of the physics involved. Linflux predicts rotor/stator tone noise and, like all the software developed by the NASA Glenn Acoustics Branch, has been rigorously validated against experimental data. Copies of Linflux can be requested from NASA’s Software Catalog.
Using estimates of turbulence intensity and characteristic length scale as input, BFANS can be used to calculate the broadband noise generated by turbulence impinging on the leading edges of the rotor blades and stator vanes. Calculations with BFANS, combined with experimental data from tests at facilities like NASA Glenn’s 9’x 15’ Low Speed Wind Tunnel, can be used to hunt down the noisiest components in a fan stage. Copies of BFANS can be requested from NASA’s Software Catalog.
RSI is a computer code for calculating the spectrum of broadband noise produced as a result of the interaction of the fan rotor wake turbulence with the fan exit guide vanes. The software computes the spectra of acoustic power upstream and downstream of the stator on a mode-by-mode basis at each frequency of interest given information about the incident turbulence characteristics. The target frequencies are arbitary and need not be harmonics of the blade passing frequency of the fan. Copies of RSI can be requested from NASA’s Software Catalog.
Propeller noise can be strongly affected by any inflow that leads to unsteady blade loading. The WOBBLE code computes the tone noise associated with propellers with varying inflow angle and predicts the axial and circumferential directivity. Inflow angle is specified in terms of yaw, pitch, and roll angles of the aircraft. The acoustic model is exact and accounts for all unsteady sources such as thickness and loading effects from the blades. Copies of WOBBLE can be requested from NASA’s Software Catalog.
Multiple pure tone noise (aka “buzz saw” noise), created by rotor locked shocks present when the fan blade tip speed is supersonic, can be estimated with the MPT code. The MPT codes also use flow predictions from a Computational Fluid Dynamics (CFD) code as input. This tool can be used by engineers to study the real-world effects of blade-to-blade difference caused during fabrication (manufacturing variations) or during hot-running operation (blade setting angle and untwist variations). Copies of the MPT code can be requested from NASA’s Software Catalog.
Developed by the Allison Engine Company under contracts with Glenn Research Center, ADPAC solves tightly coupled internal/external flows through future-concept short-duct turbofan engines. ADPAC is one of our flexible validated CFD tools. Characteristics of the problems that can be modeled with ADPAC include: 2D/axisymmetric/3D/mixed, steady/unsteady, inviscid/viscous, rotating/non-rotating/mixed components, with bleeds, leakages, and injection. ADPAC was developed specifically for propulsion system aerodynamic analysis Copies of the ADPAC code can be requested from NASA’s Software Catalog.
Need to reach us for more information about our research, software, or data? Get in touch via the link below.
8 min read
Research teams at the NASA Glenn Research Center perform experiments in world-class facilities such as the 9- by 15-Foot Low-Speed Wind Tunnel (9 x15 LSWT), the Aero-Acoustic Propulsion Laboratory (AAPL), the Small Hot Jet Acoustic Rig (SHJAR), the Nozzle Acoustic Test Rig (NATR), the DGEN AeroPropulsion Research Turbofan (DART), and the Acoustical Testing Laboratory (ATL).
The 9- by 15-Foot Low Speed Wind Tunnel is specially designed to give researchers a controlled environment to study aircraft engine aerodynamics and acoustics at takeoff and landing conditions. This helps us to reduce noise in communities near airports. Major modifications were completed in 2019 to improve the flow and lower the background noise of the tunnel. A new 5-sensor traversing microphone rake helps measure sound produced by scale experimental propulsors. Read more about the capabilities of the 9 x 15 LSWT on our facilities page.
The Aero-Acoustic Propulsion Laboratory (AAPL) is a dual-purpose 65-foot radius geodesic dome used to reduce community noise and perform aeroacoustic tests of aircraft engines and engine components. The test area inside the dome can be configured as a hemi-anechoic or anechoic chamber. There are no echoes in the dome during tests because 17,000 custom-designed 2-ft thick fiberglass wedges are mounted to the inside surface of the dome walls and placed on the floor and around test rigs to absorb sound and prevent sound reflections. When AAPL was constructed in 1993, it was the first known free-standing geodesic dome to include materials to reduce transmission of sound through the walls and absorb sound within it. AAPL currently houses the Nozzle Acoustic Test Rig (NATR), Small Hot Jet Acoustic Rig (SHJAR), and the DGEN 380 Aeropropulsion Research Turbofan (DART). Read more about the capabilities of the AAPL on our facilities page.
SHJAR is one of three rigs installed inside the anechoic dome of the Aeroacoustic Propulsion Lab. It can be used to test single stream nozzles up to 5 cm in diameter, Mach 2.0 and 800 K. SHJAR is a key tool in connecting the dots between nozzle geometry, jet flow, and noise. Creative nozzle designs are inexpensively created for this rig, and their impact on flow and noise is measured with world-leading measurement techniques. Researchers at NASA Glenn have been using SHJAR to develop advanced flow measurement techniques like Rayleigh Scattering, Raman Scattering, digital Schleiren, and real-time Particle Image Velocimetry. Three-dimensional microphone arrays have been deployed to map the sources of the noise. These techniques hold the promise of unlocking some of the mysteries of how the turbulence caused by the nozzle creates noise. The data from this rig is used to validate the computer codes that are being developed to calculate jet noise. Better noise prediction codes will help engineers design quieter nozzles.
Among the many firsts in turbulent jet research produced on SHJAR, time-resolved measurements of turbulent temperature were recently made using Raman-based optical methods, achieving high-frequency measurements of thermodynamic temperature fluctuations needed to complete turbulence models used in heat transfer as well as jet noise. In 2006, researchers had used the first time-resolved particle image velocimetry to measured space-time correlations of turbulent velocities in hot jets, a flow statistic key to the production of noise. Time-resolved velocimetry was also used to map convection speeds of turbulence, another flow metric required by jet noise theory but previously unavailable in hot jets.
The SHJAR is not only a good place to develop advanced diagnostic techniques, it has been a good testbed for exploring canonical problems in jet noise such as how the installation of the jet on an aircraft changes the noise produced by the jet. Jet-surface interaction, where the plume of the jet interacts with the wings, flaps, and tail of an aircraft, was identified as a fundamentally different noise mechanism in SHJAR tests.
Most of these ground-breaking measurement techniques and practical noise insights first developed on the relatively simple SHJAR have been deployed on the high-fidelity Nozzle Acoustic Test Rig (NATR), co-located in the Aero-Acoustic Propulsion Lab. Read more about the capabilities of the SHJAR on our facilities page.
The Nozzle Acoustic Test Rig (NATR), a free-jet wind tunnel, plays a key role in evaluating jet noise reduction concepts so that only the most promising concepts are selected for full-scale engine tests. Scale models of nozzles from both military and commercial aircraft engines can be tested in the NATR, which is one of three test rigs housed in the NASA Glenn Aero-Acoustic Propulsion Lab. The NATR can simulate take-off and landing flight conditions up to Mach 0.35. A jet engine simulator with up to three streams of air at a variety of pressures and temperatures simulate the flow of a turbofan engine to evaluate advanced nozzle concepts. The arc of microphones overhead simultaneously measures the far-field noise at all angles, allowing accurate translation of measurements to those of an actual aircraft flying overhead. The NATR enables engineers to evaluate a number of nozzle noise reduction concepts at a fraction of the cost and time required for a full-scale engine test.
Over its 30-year history, NATR has been the origin of many important jet noise breakthroughs. First built to support jet noise testing for the High-Speed Research program on commercial supersonic airliners, the facility has hosted many test programs led by NASA and industry. The chevron nozzles seen flying on today’s aircraft were first ‘discovered’ during a NASA-led test campaign in 1997. Over the years industry has used the rig to develop noise prediction methods for near-term designs. NASA has explored low-noise concepts for engines that are not yet available, such as engines with dual-fan systems. Recent tests have measured the noise likely to be heard from supersonic airliners, reducing the risk that these unique aircraft will not be allowed to fly from current airports. The tests also point to technologies to reduce their noise, allowing the aircraft designers to make the aircraft more efficient and environmentally acceptable.
The ability to test nozzle with flight is critical, as this has a strong impact on the noise produced by the relative velocity of the jet and the surrounding air, and it is a key feature allowing noise measurements to be directly transformed to what would be heard from a real airplane flying overhead. The large size of the anechoic space around the NATR is also critical to measuring the true acoustic far-field of the jet nozzle. The NATR in the Aero-Acoustic Propulsion Lab is one of the very few facilities in the world where these measurements are possible, and the only facility where both flow diagnostics and acoustics can be made on the same rig, a key capability in understanding the relationship between jet flow and noise. Read more about the capabilities of the NATR on our facilities page.
DGEN 380 is the primary component integrated into the NASA Glenn Research Center’s DGEN Aero-propulsion Research Turbofan (DART). It serves as a flexible, relevant, experimental aeroacoustic and aero-performance test bed, providing valuable information throughout NASA’s technology maturation process for a variety of multidisciplinary research that includes turbofan noise, engine controls, installation effects, and measurement technologies.
Recent tests were completed August 2019 to develop a better understanding of propulsion-noise sources to enable improved turbofan noise-prediction methods and noise-mitigation techniques. Simultaneous acoustic measurements were obtained using a circumferential infinite-tube-probe array at the core-nozzle exit in conjunction with sideline and farfield microphone arrays. The extensive data set will allow for the application of advanced source-separation and phased-array methods to elucidate not only the core-noise structure, but also the propagation characteristics of other propulsion noise sources. Read more about the capabilities of the DART on our facilities page.
The Acoustical Testing Laboratory at NASA GRC is used to support NASA’s human space exploration and aeronautics research missions. The ATL is a versatile test chamber that can be configured as an anechoic or hemi-anechoic chamber. Dense rubber material in the walls and ceiling of the ATL absorb or reflect sound from the outside. 34-inch deep fiberglass wedges that line the walls and floor are designed to absorb 99% of incident sound above 100 Hz which helps create an ideal environment for making acoustic measurements. A separate control room is attached for any noisy equipment or persons needed to perform the measurements.
The ATL has been used to quantify the noise emissions of experiments performed on the International Space Station, to measure noise sources and levels from electric motors, to calibrate microphone equipment, to measure the effectiveness of acoustic liners for aircraft engine models and to evaluate the over-the-wing engine placement for reducing takeoff and landing noise. Recent tests in the ATL have also included a scale model of a supersonic aircraft engine inlet and a spacecraft cabin ventilation fan.
To get a copies of NASA technical reports related to research in the Acoustical Testing Laboratory, please visit the NASA Technical Reports Server (NTRS).
Need to reach us for more information about our research, software, or data? Get in touch via the link below.
3 min read
To measure airflow and sound, research teams at the NASA Glenn Research Center use special instrumentation like particle image velocimetry, hot wire anemometry, Raman spectroscopy, microphones in phased arrays or continuously rotating rakes. The global aviation noise reduction community relies on data from NASA GRC experiments to validate theory and noise prediction software.
Hear an annoying tone from your turbofan engine? Engineers might prescribe an advanced liner or specially tuned active noise control system to quiet it down.
To get it right, though, more information about the modal content of the tone is needed. This kind of data can’t be measured with a stationary microphone, which is why NASA Glenn engineers pioneered procedures using rotating microphones in the 1990s.
Rotating Microphone Rakes have been used by NASA Glenn researchers in a wide variety of tests ranging from low-speed proof of concept tests in the Advanced Noise Control Fan Rig and 9- by 15-Foot Low Noise Wind Tunnel to full-scale turbofan engine ground tests.
In a phased array system, microphones are placed in a 1D, 2D or 3D arrangement and when sound measurements from these microphones are properly processed, noise sources can be pinpointed.
NASA Glenn has an Array48 microphone system that has been used extensively to locate noise sources in scale-model jet flows, a counter-rotating open rotor fan model, and even a full-scale F404 military engine. Through NASA funding, a method has been developed to use microphones embedded in the fan duct of an engine to determine the location of noise sources on the rotating blades.
We know that annoying tone noises can be created by periodic disturbances, such as when the wake from a fan blade interacts with a downstream stator vane. We also know that broadband noise is generated when an aircraft engine ingests turbulent air. Therefore, we must be able to record detailed velocity measurements of the air passing through an experimental propulsor so we can identifying noise sources and work to mitigate them. We must use special instrumentation like hotwire probes and Laser Doppler Velocimeters (LDV) to measure the air velocity upstream, downstream, and between the rotor and the stator of an experimental propulsor. Plots of the velocity measurements can be made which allow us to visualize the disturbances that the rotor created. Hotwire and LDV data are routinely used to validate calculations used to estimate noise from turbofan engines.
Need to reach us for more information about our research, software, or data? Get in touch via the link below.


We’ve all encountered the phrase AI slop, but what’s an AI slap? A meat proxy? Chatfishing? Or agentsomnia? Following up on my glossary of AI, which demystified AI jargon, Prof. Dan Weld is joining me to shine a light on the nontechnical lingo of the AI era. We also sneak in a few phrases that should exist to capture the AI zeitgeist, circa 2026.
We introduce more than 35 phrases, so we’ve divided them into sections to keep the broligarchy from crowding enshittification.
“Digital content of low quality that is produced usually in quantity by means of artificial intelligence,” which is how Merriam-Webster defined slop, its 2025 word of the year. Shrimp Jesus is the specimen, Christ fused with crustaceans, posted to Facebook by the thousands.
AI cream is our name for the rare opposite, superb writing authored with the help of AI. We hope that over time the cream will rise to the top and the slop will sink.
Until that happens, we have the meat proxy, “a person who forwards AI-generated text, code, or other output without reading, understanding, or validating it.” We call the action of sending AI-generated text blindly an AI slap. It stings.
Your AI Slop Bores Me is a website where you type a prompt and a randomly chosen human answers it while pretending to be a chatbot. Fifty million views in a week, which tells you how badly people wanted to say something back.
AI suspicion is our name for the nagging feeling that what you’re reading was AI generated. You could also call it Turing tingle or AI-dar.
AI shaming is the accusation that follows, attacking someone’s work by insinuating a machine wrote it. The paper that named it is subtitled “Birth of a Classist Slur in Knowledge Work,” and it argues that the accusations fall hardest on racial minorities and on writers whose first language isn’t English.
See also: tasteslop, workslop, slopaganda.
A video or recording altered by machine learning so that a real person appears to say or do something they never said or did. Named in late 2017 for the Reddit user who called himself deepfakes. The word we all use for AI deception descends from one anonymous pornographer’s handle.
The liar’s dividend is the payoff a real wrongdoer collects once any authentic recording can be waved off as a fake. The damage isn’t the fake video. It’s that real video stops counting.
Counterfeit people was Daniel Dennett’s last argument, that machines able to pass as human are “the most dangerous artifacts in human history, capable of destroying not just economies but human freedom itself.” He wanted them outlawed and watermarked like banknotes.
Tilly Norwood is one of them, an AI actress unveiled at the Zurich Film Festival in September 2025. Her makers said talent agents wanted to sign her. Emily Blunt, shown a picture, said “Good Lord, we’re screwed” and told the agencies to stop.
Most of the damage doesn’t need AI at all. A cheapfake is manipulation made with cheap software or none at all. Chatfishing is using AI to write your messages on a dating app, where the con used to be a fake photo and is now a rented personality.
A name for the Silicon Valley billionaires and venture capitalists who think democracy is finished and want corporate rule in its place. Gil Durán’s book, subtitled Silicon Valley Fascism and the War on Democracy, traces the idea to a 1997 book, The Sovereign Individual, and to Peter Thiel’s circle, which Durán says believes “technology means democracy is an obsolete software system.”
Durán didn’t coin the phrase. Someone in the crypto world told him they’d been using it for years.
Durán’s target is the broligarchy, “a small group of extremely wealthy men, particularly those in technology, who wield significant political and economic power.” The word sat on Twitter from 2009 and went nowhere until Carole Cadwalladr wrote about “a new super-class of broligarchs” in July 2024.
See also: technofeudalism.
The mental deterioration that comes from consuming too much junk online, chosen by Oxford University Press as its 2024 word of the year. Thoreau got there first, in Walden in 1854, complaining that England was busy curing the potato-rot while nobody was curing the brain-rot.
Dead internet theory is the supply side, “a theory that a lot of the internet is no longer created by real people but rather by bots and other AI tools.” It started as a forum post in January 2021 and is quietly turning into a description.
Enshittification is Cory Doctorow’s three-stage decay: “first, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves.”
AI fatigue is what’s left over, “the exhaustion or the sense of being overwhelmed by the rapid proliferation and constant engagement with artificial intelligence technologies.” The phrase has been drifting through the trade press since 2023 with no author attached; the definition above comes from Route Fifty, a trade publication for state and local government.
Andrej Karpathy’s February 2025 coinage, crowned Collins Dictionary’s word of the year for 2025, is “fully giving in to the vibes, embrac[ing] exponentials, and forget[ting] that the code even exists”—accepting whatever diff the AI hands you without reading it.
Promptatory is our word, styled on “purgatory,” for the state of being trapped in an unending edit-and-re-prompt loop with an AI system. You fix the bug the AI introduced, and in fixing it, the AI introduces two more, each smaller and more absurd than the last. Progress is hard earned: you close in on “done” like the runner in Zeno’s paradox, forever eating the remaining distance in half. Promptatory is vibe coding’s hangover: the vibe wears off, and the rereading begins.
A related condition we dub agentsomnia is the chronic inability to rest or disconnect from work, driven by the haunting feeling that your autonomous software or AI agents are stalled without your feedback. The Wall Street Journal calls it agent FOMO.
An OpenAI rallying cry. AGI is the point where a machine can do any intellectual task a person can, and the phrase became a general exclamation for the moment a model does something that rearranges your sense of what’s coming. Ilya Sutskever used it inside the company and posted it publicly in 2022. It works as celebration and as diagnosis.
P(doom) runs in the other direction: “your personal probability that AI ends the world, stated as a number so the vibe feels like math.” It started as shorthand among a small online community in 2022 and now gets asked at dinner parties.
Talk that outruns the technology comes in other flavors too.
Bragawatts, a unit of measurement for boasting, is “the practice of AI companies boasting about very large projects to create excitement and attract investment, even though many of these projects are never completed,” as Britain’s Cambridge Dictionary put it in January 2026.
Vibe revenue does the same thing to the income statement, “money or funding that an AI company is given because people are excited about the potential of AI, rather than because the company’s products are already successful.”
A one-sided relationship with someone who doesn’t know you exist. Donald Horton and Richard Wohl coined it in 1956 about television viewers, and Britain’s Cambridge Dictionary made it the 2025 word of the year, citing celebrities, influencers, and chatbots. A seventy-year-old term about Ed Sullivan turns out to describe your relationship with ChatGPT.
AI addiction is what happens when the one-sided relationship takes over. A 2026 study sorted it into three kinds: escapist roleplay, where people come to prefer the world the chatbot builds; pseudosocial companionship, where it replaces the relationships; and the epistemic rabbit hole, compulsive question-asking that crowds out everything else.
The researchers blame the design and call the chatbot an AI genie, a thing that gives you exactly anything you want with minimal effort.
AI psychosis is the far end, “a phenomenon wherein individuals reportedly develop or experience worsening psychosis, such as paranoia and delusions, in connection with their use of chatbots.” The Danish psychiatrist Søren Dinesen Østergaard suggested the term in a 2023 editorial in the journal Schizophrenia Bulletin. It isn’t a recognized clinical diagnosis, and we should say so.
See also: wireborn.
Nearly every phrase above names a problem. Slop, shaming, deepfakes, brain rot, psychosis: what the AI era has added to English so far is a vocabulary of complaint. There’s still no common word for AI doing something well. We’ve offered AI cream. If you have a candidate for a phrase we’re missing, please send it to us.
The USN Journal is one of the most useful forensic artifacts on an NTFS volume, but it can also be extremely noisy.
From Raw Data to Actionable Findings
CQUSNDeepAnalyzer processes the raw $J stream and can optionally use the MFT for full path reconstruction.
It also includes built-in YARA rules, behavioral detection, and enrichment from EVTX and Prefetch data.
In the demo, we run the tool against a real journal dump and immediately uncover several interesting findings:
1. More than 1,500 rename records in a burst.
2. Nearly 50,000 file deletions.
3. Fifteen new file extensions appearing only in the last part of the timeline.
4. Search for known cryptominer binaries.
5. Nearly 400 related events across 53 files.
The combination of mass renames, mass deletes, and newly appearing extensions is especially interesting because it can be associated with early-stage ransomware activity.
Interactive Forensic Analysis
The tool deals with huge amounts of records and presents the findings in an interactive HTML report.
Instead of manually reviewing thousands of raw entries, investigators can explore:
1. An activity timeline.
2. Severity-ranked findings.
3. Reason flags over time.
4. An hour-by-day heatmap.
5. A Sankey diagram connecting reasons, file extensions, and paths.
6. File extension statistics.
7. A path treemap showing where suspicious activity occurred.
Every underlying record remains searchable and filterable, and the results can be exported to CSV for further analysis.
Why It Matters
During investigation, the biggest challenge is often not collecting forensic data, but finding the important activity hidden inside it.
CQUSNDeepAnalyzer helps transform a raw USN Journal into a structured timeline that makes suspicious file operations, malware indicators, and behavioral patterns much easier to investigate. From a raw journal blob to an investigation-ready timeline. That is CQUSNDeepAnalyzer.

If you’re reading this article, use the discount code CQBLOG_AMSC27_HACKS85 at checkout – a special offer created exclusively for readers of this article. The code applies to our flagship course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.

Join our FREE live webinar:
Secure Users: Designing Workstations for Threat Resistance
Workstation security depends on how privileged access, authentication, endpoint configuration, and monitoring work together.
Join Paula Januszkiewicz, Sami Laiho, and Artur Kalinowski for a practical session on designing and deploying Privileged Access Workstations (PAWs), implementing passkeys securely, and identifying workstation and identity misconfigurations that weaken security.
Through practical demonstrations, discover how to strengthen workstation defenses, identify the authentication events and security changes that matter, and connect endpoint and identity activity to actionable detections. You will also learn how to validate that security evidence is collected and alerts trigger as expected.
Leave with an actionable checklist for PAW design, passkey deployment, workstation hardening, configuration reviews, and monitoring validation.
Register for free:
https://luma.com/SecureUsers
Want to know more?
The post CQURE Hacks #85: CQUSNDeepAnalyzer: Turn the USN Journal into a Forensic Timeline appeared first on CQURE Academy.
Event ID 4624 is one of the most important Windows events for monitoring successful logons.
We start by enabling detailed logon auditing on the Domain Controller and then generate several different logon scenarios, including:
1. Workstation unlocks, Logon Type 7
2. Local interactive logons, Type 2
3. Network authentication, Type 3
4. New logon session with alternate credentials for network connections, Type 9
5. RDP sessions, Types 7 and 10
6. Service logons, Type 5
We also demonstrate how SMB activity from Kali Linux appears on the Domain Controller and which fields are most useful during analysis, including:
1. Logon Type
2. Logon Process
3. Authentication Package
4. Source Network Address
The key takeaway is that Event ID 4624 becomes most valuable when you correlate its fields and understand the context behind the logon.
A single Type 3, Type 7, or Type 9 event may be completely legitimate. But when you combine the logon type with the account used, source IP address, authentication package, and surrounding activity, it becomes much easier to distinguish normal behavior from activity worth investigating. That is why Event ID 4624 is such a valuable source for Windows authentication analysis, threat hunting, and lateral movement investigations.

After restoring Bob’s original UPN, the certificate is used for authentication and is mapped by the KDC to the real Administrator account. This allows us to obtain an Administrator TGT and recover the Administrator NT hash.
With Domain Admin privileges, the demonstration concludes with DCSync, retrieving the krbtgt account hash.
The attack highlights why AD CS configuration, certificate mapping settings, and permissions to modify identity attributes such as userPrincipalName should all be carefully reviewed. A seemingly small certificate configuration issue can become part of a complete domain compromise.

Join our FREE live webinar:
Uncovering New Identity Theft Vectors and How to Mitigate Them
Discover how identity theft no longer begins and ends with a stolen password.
Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.
Register for free:
https://luma.com/TheftVectors
Want to know more?
The post CQURE Hacks #84: Understanding Event ID 4624 in Action appeared first on CQURE Academy.
ESC16 occurs when a Certificate Authority is configured not to include the SID security extension in issued certificates. This extension provides a strong binding between a certificate and the Active Directory account for which it was issued. If the extension is absent and the Domain Controller permits weak certificate mapping, certificate identities such as the UPN can potentially be used to map the certificate to another account.
In the demonstration, a low-privileged user named bob is able to modify his userPrincipalName. We temporarily change his UPN to Administrator and request a standard user certificate. Because the CA does not add the SID security extension, the issued certificate contains the Administrator UPN without being strongly bound to Bob’s SID.

After restoring Bob’s original UPN, the certificate is used for authentication and is mapped by the KDC to the real Administrator account. This allows us to obtain an Administrator TGT and recover the Administrator NT hash.
With Domain Admin privileges, the demonstration concludes with DCSync, retrieving the krbtgt account hash.
The attack highlights why AD CS configuration, certificate mapping settings, and permissions to modify identity attributes such as userPrincipalName should all be carefully reviewed. A seemingly small certificate configuration issue can become part of a complete domain compromise.

Join our FREE live webinar:
Uncovering New Identity Theft Vectors and How to Mitigate Them
Discover how identity theft no longer begins and ends with a stolen password.
Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.
Register for free:
https://luma.com/TheftVectors
Want to know more?
The post CQURE Hacks #83: Attack on Active Directory Certificate Services (AD CS) – ESC16 appeared first on CQURE Academy.