The same suspicious installer appeared in two unrelated client environments. Antivirus quarantined it, but I still needed to understand how it arrived.
I wrote up the case for fellow MSPs and defenders: where browser history helped, where my collector fell short, and what remained unresolved. Client details are anonymized.
https://www.kylereddoch.me/blog/client-case-study-tracing-a-suspicious-download-after-quarantine/
CybersecKyleClient Case Study: Investigating a Quarantined MSIX DownloadAn anonymized case from my client work, with practical lessons for MSPs and defenders on tracing a suspicious download, checking collection gaps, and reporting what the evidence supports.