Three NTFS bugs, one VHD file, and what your logs should already be telling you

A DFIR-focused look at three NTFS heap overflow vulnerabilities exploited through crafted VHD files, with detection rules and forensic artefacts to hunt for.