“Now, here, you see, it takes all the running you can do, to keep in the same place.” — The Red Queen, Through the Looking-Glass

Your SOC monitors human sign-ins. Attackers compromise service principals. Here’s how to detect the full NHI kill chain — with…

Now that I’ve hopefully gotten your attention… I’m also writing a book!

If you’ve spent any time writing detection rules for process masquerading, you know the game: an attacker uses scvhost.exe instead of…

YouTube video by KoifSec

TL;DR LUMEN is a privacy-first, browser-native EVTX analysis platform that combines WebAssembly parsing, 2,349 SIGMA detection rules…

I recently ran a Kali VM against a Windows test host and instrumented the target with Procmon and WMI/Windows logs to see how a new…

1. Introduction

Permiso launches Inboxfuscation, an open-source tool enabling organizations to detect Unicode-obfuscated Microsoft Exchange inbox rules and secure Microsoft 365.

This tutorial shows how to use the pstree command & app to help you look through all the processes you have to investigate.

Hello all! 👋 It’s been a while since my last post. I wasn’t finding anything exciting to write about — until this story caught my…

BitLocker is a full disk encryption feature which was designed to protect data by providing encryption to entire volumes. In Windows endpoints (workstations, laptop devices etc.), BitLocker is typi…

Detection engineering isn’t just about finding bad behavior. It’s about understanding how attackers appear normal — on accident or by…

“Until you make the unconscious conscious, it will direct your life — and you will call it fate.” — Carl Jung