iiinova — where your digital self keeps evolving

Kostas @kostastsale.bsky.social · 01/04/2026

This is one of the funniest things I’ve seen this year 😂 😂 vibecoded.vc/cooked/

Kostas @kostastsale.bsky.social · 26/03/2026

📢🍏 macOS is now part of the EDR Telemetry Project. After three months of focused work, we’re excited to share a new framework and generator for endpoint visibility on macOS! Huge thank you to everyone who contributed and helped shape this release. Looking forward to what comes next.

edr-telemetry.com

macOS EDR Telemetry: A Structured Framework for Evaluating Endpoint Visibility.

EDR Telemetry Project - Exploring telemetry capabilities of EDR solutions

020

Kostas @kostastsale.bsky.social · 25/03/2026

It’s been quiet on the EDR Telemetry side lately while working on something big! EDR telemetry's goal was always to set the standard for telemetry visibility, and this is what we're planning to do with tomorrow's release... Keep an eye out for tomorrow's announcement!

010

Kostas @kostastsale.bsky.social · 06/03/2026

Sometimes the call comes a little too late and you gotta do what you gotta do 😂

030

Kostas @kostastsale.bsky.social · 20/02/2026

𝗛𝘂𝗻𝘁 𝗳𝗼𝗿 𝘁𝗵𝗶𝘀 𝗯𝘆 𝗹𝗼𝗼𝗸𝗶𝗻𝗴 𝗮𝘁: • Chrome/Edge running on servers where they shouldn't be • Browser profile directory access by non-browser processes • Outbound HTTPS to api.telegram.org from unexpected executables • Startup persistence under AppData or ProgramData without operational justification

api.telegram.org

Bots: An introduction for developers

Bots are small applications that run entirely within the Telegram app. Users interact with bots through flexible interfaces…

030

Kostas @kostastsale.bsky.social · 20/02/2026

I'm using TelePeek.com to monitor the receiving interface (screenshot shows operator's dashboard). The victim profile is concerning with government employees and enterprise users in high-level organizations...

telepeek.com

TelePeek - Telegram Bot Investigation

Professional tool to securely track and analyze bot interactions

100

Kostas @kostastsale.bsky.social · 20/02/2026

Exfiltration via Telegram bot API where PhantomStealer packages victim data as JSON and POSTs directly: • Browser credentials, cookies, saved passwords • System metadata (OS, username, antivirus status) • Network reconnaissance (gateway/internal/external IPs)

telepeek.com

TelePeek - Telegram Bot Investigation

Professional tool to securely track and analyze bot interactions

110

Kostas @kostastsale.bsky.social · 20/02/2026

Phantom Stealer has been prominent across phishing campaigns over the past two weeks. Operationally interesting to me is that it’s not just an infostealer. It also acts as an initial access broker, dropping GuLoader for follow-on activity, and I’ve seen it deploy crypto miners as well.

152

Kostas @kostastsale.bsky.social · 18/02/2026

Clinejection PoC: researcher proved you can compromise a VS Code extension (700k+ weekly users) via prompt injection in GitHub issues. He was kind enough to install harmless software as a POC. Real attackers won't... Vendor ignored him for 47 days, fixed it in 30 min after he went public.

github.com

Unauthorized npm publish of Cline CLI cline@2.3.0 with modified postinstall script to install openclaw

### Description On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published pac...

111

Kostas @kostastsale.bsky.social · 13/02/2026

MDX content is awesome, I love it, and I use it whenever I can on my projects. But be careful cause if you’re using next-mdx-remote (4.3.0–5.x) to server‑side render untrusted MDX, you’re potentially exposing yourself to RCE via CVE‑2026‑0969...

discuss.hashicorp.com

HCSEC-2026-01 - Arbitrary code execution in React server-side rendering of untrusted MDX content

Bulletin ID: HCSEC-2026-01 Affected Products / Versions: next-mdx-remote from 4.3.0 up to 5.0.0, fixed in 6.0.0. Publication Date: February 11, 2026 Summary The serialize function used to compile…

110

Kostas @kostastsale.bsky.social · 13/01/2026

At EDR Telemetry project, we spend a lot of time measuring what EDRs can see. This article is about what they still cannot safely stop. From LOLBAS to vulnerable drivers to unauthorized RMMs, I walk through the real-world gaps we keep seeing in telemetry and why application control is...

edr-telemetry.com

Why Your EDR Needs a Partner: The Case for Application Control

How threat intelligence-aware application control fills the gaps that EDR leaves open

101

Kostas @kostastsale.bsky.social · 08/01/2026

In the screenshot below, you can see an example of this Skill in use (I'm using GPT 5.2-low in Codex) Link to the skill: github.com/tsale/awesom...

github.com

020

Kostas @kostastsale.bsky.social · 08/01/2026

We have added a new analysis Skill thanks to @BlueTeamSteve! This skill can be used to quickly and accurately map the MITRE ATT&CK tactic and technique to threat behaviors and indicators you enter in the prompt, saving you a ton of time!

github.com

100

Kostas @kostastsale.bsky.social · 07/01/2026

We’ve also expanded 𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 options for organizations that need additional flexibility, scale, and support on top of the Advanced tier. Check out the new tiers now: www.edr-comparison.com/pricing

edr-comparison.com

EDR Comparison - Compare Endpoint Detection & Response Solutions

Make informed security decisions with expert EDR comparisons. Compare endpoint detection and response solutions with detailed feature analysis and side-by-side comparisons.

000

Kostas @kostastsale.bsky.social · 07/01/2026

𝗪𝗮𝘁𝗰𝗵𝗚𝘂𝗮𝗿𝗱 𝗘𝗗𝗥. We’ve also introduced 𝗕𝗮𝘀𝗶𝗰 𝗮𝗻𝗱 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝘁𝗶𝗲𝗿𝘀 to better reflect how different users engage with the platform. With the 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝘁𝗶𝗲𝗿, we’re introducing a deep dive into the technical justification and expert analysis behind every single feature in our comparison.

edr-comparison.com

EDR Comparison - Compare Endpoint Detection & Response Solutions

Make informed security decisions with expert EDR comparisons. Compare endpoint detection and response solutions with detailed feature analysis and side-by-side comparisons.

100

Kostas @kostastsale.bsky.social · 07/01/2026

Since launching in November, the platform has already helped hundreds of consultants and enterprises navigate the complexity of EDR selection. This release pushes things forward with a cleaner comparison UX, deeper evaluation context using MITRE ATT&CK evaluation data, and a new vendor added:

100

Kostas @kostastsale.bsky.social · 07/01/2026

𝗘𝗗𝗥 𝗖𝗼𝗺𝗽𝗮𝗿𝗶𝘀𝗼𝗻 𝗣𝗹𝗮𝘁𝗳𝗼𝗿𝗺 𝗨𝗽𝗱𝗮𝘁𝗲: 𝗡𝗲𝘄 𝗜𝗻𝘁𝗲𝗿𝗮𝗰𝘁𝗶𝘃𝗲 𝗖𝗼𝗺𝗽𝗮𝗿𝗶𝘀𝗼𝗻 𝗘𝘅𝗽𝗲𝗿𝗶𝗲𝗻𝗰𝗲, 𝗠𝗜𝗧𝗥𝗘 𝗔𝗧𝗧&𝗖𝗞 𝗜𝗻𝘀𝗶𝗴𝗵𝘁𝘀, 𝗮𝗻𝗱 𝗪𝗮𝘁𝗰𝗵𝗚𝘂𝗮𝗿𝗱 𝗘𝗗𝗥 We want to start by thanking everyone who supported us as early adopters.

edr-comparison.com

EDR Comparison - Compare Endpoint Detection & Response Solutions

Make informed security decisions with expert EDR comparisons. Compare endpoint detection and response solutions with detailed feature analysis and side-by-side comparisons.

100

Kostas @kostastsale.bsky.social · 30/12/2025

Feel free to contribute and use these skills to save a ton of time, like we already do. github.com/tsale/awesom... Learn about skills: - developers.openai.com/codex/skills/ - support.claude.com/en/articles/...

github.com

GitHub - tsale/awesome-dfir-skills: A curated collection of DFIR skills and workflows for InfoSec practitioners.

A curated collection of DFIR skills and workflows for InfoSec practitioners. - tsale/awesome-dfir-skills

030

Kostas @kostastsale.bsky.social · 30/12/2025

𝗝𝘂𝘀𝘁 𝗹𝗮𝘂𝗻𝗰𝗵𝗲𝗱 𝗮𝘄𝗲𝘀𝗼𝗺𝗲-𝗱𝗳𝗶𝗿-𝘀𝗸𝗶𝗹𝗹𝘀 𝘄𝗶𝘁𝗵 @fr0gger_ ! Designed to save time during investigations and everyday DFIR tasks Thomas has built an excellent malware triage skill, and I’ve added a couple of timeline analysis skills to help you get started.

github.com

GitHub - tsale/awesome-dfir-skills: A curated collection of DFIR skills and workflows for InfoSec practitioners.

A curated collection of DFIR skills and workflows for InfoSec practitioners. - tsale/awesome-dfir-skills

121

Kostas @kostastsale.bsky.social · 29/12/2025

github.com/tsale/EDR-Te... This is exactly the kind of vendor collaboration the project aims to promote. PR with full details and artifacts: github.com/tsale/EDR-Te... Big thanks to the C-Prot team for setting a strong example for Linux EDR transparency.

000

Kostas @kostastsale.bsky.social · 29/12/2025

environment, validated event mappings, and published the raw logs from the evaluation so the community can independently verify everything. Artifacts included: • Real production telemetry logs • Some screenshots from the platform Validation material to reproduce the results can be found under

100

Kostas @kostastsale.bsky.social · 29/12/2025

We’ve just added 𝗖-𝗣𝗿𝗼𝘁 EDR to the EDR Telemetry Project and it sets a new bar for Linux telemetry! C-Prot is currently #1 in the Linux EDR table, with exceptional depth and quality of raw telemetry. What really stands out is the level of transparency: we got direct access to a production...

github.com

Add C-Prot telemetry coverage to Linux EDR telemetry matrix by tsale · Pull Request #151 · tsale/EDR-Telemetry

EDR Telemetry Pull Request Contribution Details Adding comprehensive Linux telemetry support for C-Prot EDR, including detailed event mappings, field explanations, and validation artifacts. This co...

120

Kostas @kostastsale.bsky.social · 27/12/2025

One quick caveat tho, as skills libraries become more popular, where you will be able to search and find the right skill you want to install, we’re likely going to see malicious skills pop up that download and execute malware...

support.claude.com

What are Skills? | Claude Help Center

Skills are available as a feature preview for users on Pro, Max, Team, and Enterprise plans. This feature preview requires code execution to be enabled. Skills are also available in beta for Claude…

100

Kostas @kostastsale.bsky.social · 27/12/2025

Claude set a strong bar for structured, workflow-driven AI usage, and it’s no surprise we’re now seeing similar ideas across other platforms like OpenAI. I’ve built DFIR and quick triage workflows that save me hours every time! The time savings really add up, and it’s completely changed how I work.

developers.openai.com

Agent Skills

Give Codex new capabilities and expertise

130

Kostas @kostastsale.bsky.social · 25/12/2025

Merry Christmas everyone! Hope everyone’s enjoying some downtime 🎄

110

Kostas @kostastsale.bsky.social · 23/12/2025

Much of it remains applicable today, along with the threat hunting series, which I’m especially proud of.

020

Kostas @kostastsale.bsky.social · 23/12/2025

I’ve moved all of my blog posts from Medium to a new blog section on my personal website. If you’re looking for a good read, I’d recommend my Cobalt Strike write-ups (Part 1 & Part 2) from 2021–2022. kostas.page/blog/cobalt-...

kostas.page

Cobalt Strike, a Defender's Guide - Part 2

The second part of the Cobalt Strike defender's guide, focusing on network traffic analysis and practical detection methods to identify Cobalt Strike beacons in your environment.

150

Kostas @kostastsale.bsky.social · 18/12/2025

Don't be naive. They will get rid of you at the first opportunity they find.

000

Kostas @kostastsale.bsky.social · 18/12/2025

Many large companies are using AI and forcing their employees to use their AI models. They do this to train their AI models, getting them ready to replace many low-level analyst positions. If you are a security analyst in one of these big organizations, you need to have plan B….

100

Kostas @kostastsale.bsky.social · 16/12/2025

Haha thank you, man! Appreciate you. Jokes aside, having passion and doing what you love is a big motivator. Helping people is also another one. At the end, we all come out winners.

010

Kostas @kostastsale.bsky.social · 16/12/2025

Ah, dammit! I think that might be an issue with the mobile version of the website. I'll check it out and fix it. Thank you very much! I guess this adds an element of challenge for signing up 😂 Regarding your question, it's easy, I don't sleep 😂

110

Kostas @kostastsale.bsky.social · 16/12/2025

The waitlist will close once a certain number of people have signed up and may reopen later if more testers are needed. This is something I wish existed when I was starting in the industry, and something I still want today. Register now, and more details soon. threathuntinglabs.com

threathuntinglabs.com

ThreatHunting Labs | Real Intrusion Training

Hands-on threat hunting labs built from real intrusions, not simulations. Join the waitlist for early access.

010

Kostas @kostastsale.bsky.social · 16/12/2025

• Work directly in 𝗘𝗹𝗮𝘀𝘁𝗶𝗰, 𝗦𝗽𝗹𝘂𝗻𝗸, 𝗼𝗿 𝗔𝘇𝘂𝗿𝗲 𝗗𝗮𝘁𝗮 𝗘𝘅𝗽𝗹𝗼𝗿𝗲𝗿 and learn to investigate and hunt using hypotheses. 𝗧𝗵𝗲 𝘄𝗮𝗶𝘁𝗹𝗶𝘀𝘁 𝗶𝘀 𝗻𝗼𝘄 𝗼𝗽𝗲𝗻!! Those who sign up will receive a founders discount, early beta access, and the opportunity to provide feedback during development.

threathuntinglabs.com

ThreatHunting Labs | Real Intrusion Training

Hands-on threat hunting labs built from real intrusions, not simulations. Join the waitlist for early access.

110

Kostas @kostastsale.bsky.social · 16/12/2025

actually work, not another set of CTF-like labs or check-the-box exercises. • 𝗖𝗵𝗼𝗼𝘀𝗲 𝘆𝗼𝘂𝗿 𝗼𝘄𝗻 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗶𝗻𝘃𝗲𝘀𝘁𝗶𝗴𝗮𝘁𝗶𝗼𝗻 𝗽𝗮𝘁𝗵: your choices determine how the investigation unfolds. • 𝗡𝗼 𝗺𝗼𝗿𝗲 𝗸𝗲𝘆𝘄𝗼𝗿𝗱 𝗺𝗮𝘁𝗰𝗵𝗶𝗻𝗴. Answers are evaluated on intent and accuracy.

threathuntinglabs.com

ThreatHunting Labs | Real Intrusion Training

Hands-on threat hunting labs built from real intrusions, not simulations. Join the waitlist for early access.

110

Kostas @kostastsale.bsky.social · 16/12/2025

📢 𝗜’𝗺 𝗮𝗻𝗻𝗼𝘂𝗻𝗰𝗶𝗻𝗴 𝗧𝗵𝗿𝗲𝗮𝘁 𝗛𝘂𝗻𝘁𝗶𝗻𝗴 𝗟𝗮𝗯𝘀, 𝗹𝗮𝘂𝗻𝗰𝗵𝗶𝗻𝗴 𝗻𝗲𝘅𝘁 𝘆𝗲𝗮𝗿! After building threat hunting teams for large MSSPs, creating DFIR Labs for TheDFIRReport, and sharing years of free threat hunting material, I want to bring everything together into one platform. Something closer to how investigations...

threathuntinglabs.com

ThreatHunting Labs | Real Intrusion Training

Hands-on threat hunting labs built from real intrusions, not simulations. Join the waitlist for early access.

240

Kostas @kostastsale.bsky.social · 15/12/2025

However, those improvements still need to be interpreted in context, and understanding the access used during evaluation for additional context. This post explains what changed and why: www.edr-telemetry.com/blog/Behind-...

edr-telemetry.com

Behind the Curtain: How the EDR Telemetry Project Approaches Vendor Relations, Evaluations, and Transparency

Introducing transparency indicators and explaining how we validate telemetry while staying independent.

010

Kostas @kostastsale.bsky.social · 15/12/2025

That's why we are introducing transparency indicators, to help you clearly see when validation is done via direct access, community contributions, evidence-only, etc. We’re happy to celebrate along with vendors that improve their telemetry visibility over time.

edr-telemetry.com

Behind the Curtain: How the EDR Telemetry Project Approaches Vendor Relations, Evaluations, and Transparency

Introducing transparency indicators and explaining how we validate telemetry while staying independent.

110

Kostas @kostastsale.bsky.social · 15/12/2025

𝗜𝗻𝘁𝗿𝗼𝗱𝘂𝗰𝗶𝗻𝗴: 𝗧𝗿𝗮𝗻𝘀𝗽𝗮𝗿𝗲𝗻𝗰𝘆 𝗜𝗻𝗱𝗶𝗰𝗮𝘁𝗼𝗿𝘀 𝗶𝗻 𝘁𝗵𝗲 𝗘𝗗𝗥-𝗧𝗲𝗹𝗲𝗺𝗲𝘁𝗿𝘆 𝗣𝗿𝗼𝗷𝗲𝗰𝘁! Transparency has always been central to the EDR Telemetry Project. Evaluations may involve different levels of access, and making that visible adds helpful context for readers.

edr-telemetry.com

Behind the Curtain: How the EDR Telemetry Project Approaches Vendor Relations, Evaluations, and Transparency

Introducing transparency indicators and explaining how we validate telemetry while staying independent.

120

Kostas @kostastsale.bsky.social · 12/12/2025

⊕We’ve added 𝗖𝗶𝘀𝗰𝗼 𝗦𝗲𝗰𝘂𝗿𝗲 𝗘𝗻𝗱𝗽𝗼𝗶𝗻𝘁 to the EDR-Comparison.com platform!! Cisco shows strength in prevention, indicator alerting, and response automation, with solid investigation visuals and well-documented APIs that integrate easily into broader security stacks. It’s a platform that leans more...

110

Kostas @kostastsale.bsky.social · 10/12/2025

Current pricing stays in place until the end of December. January introduces the updated tiers aligned with the expanded roadmap and long-term support. If you’ve been thinking about joining, now is the best time -> edr-comparison.com

edr-comparison.com

EDR Comparison - Compare Endpoint Detection & Response Solutions

Make informed security decisions with expert EDR comparisons. Compare endpoint detection and response solutions with detailed feature analysis and side-by-side comparisons.

010

Kostas @kostastsale.bsky.social · 10/12/2025

• New EDR evaluation playbooks and guided walkthroughs • More support for consultants who need faster, defensible reporting for client engagements The goal is to deliver a clearer, faster way to evaluate EDR products with real practitioner-led data, not marketing jargon.

edr-comparison.com

EDR Comparison - Compare Endpoint Detection & Response Solutions

Make informed security decisions with expert EDR comparisons. Compare endpoint detection and response solutions with detailed feature analysis and side-by-side comparisons.

110

Kostas @kostastsale.bsky.social · 10/12/2025

• More EDR vendors evaluated (Cisco EDR will join the list this week!) • Integration of MITRE ATT&CK evaluation data into the comparison views, calculations and vendor reports • Integration of EDR Telemetry Project findings directly inside each vendor profile and final calculations

edr-comparison.com

EDR Comparison - Compare Endpoint Detection & Response Solutions

Make informed security decisions with expert EDR comparisons. Compare endpoint detection and response solutions with detailed feature analysis and side-by-side comparisons.

100

Kostas @kostastsale.bsky.social · 10/12/2025

As we are are approaching our goal, starting January, we’re updating the pricing for the 𝗘𝗗𝗥 𝗙𝗲𝗮𝘁𝘂𝗿𝗲 𝗖𝗼𝗺𝗽𝗮𝗿𝗶𝘀𝗼𝗻 𝗦𝗲𝗿𝘃𝗶𝗰𝗲. The platform has grown far beyond the initial dataset, and the new pricing reflects the depth of work going into the next phase of the project. 𝗪𝗵𝗮𝘁’𝘀 𝗰𝗼𝗺𝗶𝗻𝗴 𝗻𝗲𝘅𝘁:

edr-comparison.com

EDR Comparison - Compare Endpoint Detection & Response Solutions

Make informed security decisions with expert EDR comparisons. Compare endpoint detection and response solutions with detailed feature analysis and side-by-side comparisons.

110