In the cloud there is often no host to image and no disk to acquire. The audit trail becomes the evidence, and identity becomes the thing you hunt.

LD_PRELOAD lets an attacker intercept almost any library call without touching the program itself. This guide covers how the technique works, how to find it on a live host, and how to tell abuse from legitimate use.

A free two-sided A3 poster on Kunai threat hunting: what Kunai records on a Linux host, and 14 tested jq hunts and rules you can run today.

Insider exfiltration uses ordinary routes: USB, personal cloud storage, webmail, print and the phone camera nobody logs.

Some weight files run code the moment they load. Which formats, by what mechanism, and why scanning has become the weaker answer.

Counting hunts measures effort. Boards fund outcomes. Here is a starter set of hunting metrics that reports honestly and still earns next year's budget.

AND, OR, XOR and the shift instructions manipulate individual bits, and they appear everywhere from permission checks to obfuscated malware. This post explains what each does and why analysts meet them so often.

Encryption hides content, not behaviour. Beacon rhythm, DNS abuse and TLS metadata still expose command and control without a single decrypted byte.

A flat process list tells you what is running. The tree tells you what started it. This guide covers reading Linux process lineage, exposing renamed processes and recovering a deleted binary through /proc.

An employee's AI prompt history is a record of what they asked for, including the requests they thought better of. It needs handling with care.

Enthusiasm produces a few good hunts. A workflow produces them every month, and keeps producing them after the enthusiast leaves.

Every add and subtract quietly updates the CPU flags, and every conditional branch reads them. This post explains the arithmetic instructions and the four flags that drive program decisions.

A hunt you can only run by hand does not scale. Here is how to turn your findings into a repeatable IOC scanner, with a free tool and a YARA rule pack.

Unapproved inference servers are easy to find once you know what to look for. The defaults matter more than the port numbers.

Buying a feed is not intelligence-driven hunting. Here is how to turn a threat report into behaviours worth hunting, and why indicators alone age badly.

Falco, Tracee, Tetragon, Sysdig and Jibril all promise kernel-level visibility. This guide compares them from a responder's perspective and covers how to find out what is already running on a compromised host.

The same access, at the same hour, by the same person is either routine or the whole case. What separates them is context, not telemetry.

The tooling is rarely the expensive part. Data retention and protected analyst time are where a hunting budget actually goes.

Assembly has no if statements or while loops, only compares and jumps. This post shows how the familiar high-level structures are built from those parts, and how to recognise each pattern in disassembly.

Advanced attackers make the host lie to your tools. Here is how to catch the lie on Linux by cross-checking independent views, with two free tools.

The artefact map for a local AI deployment: model storage, caches, configuration, conversation records and the credentials sitting alongside them.

Every hunt is limited by what your telemetry can see. Mapping that honestly is duller than hunting, and it changes the results more than any tool will.

Your donations really make a difference. We depend on your generosity to educate people to stay safe and prevent tragedies on and offshore. Donate here.

A default Linux server records nothing about process creation. This guide covers Sysmon for Linux and Kunai, how to confirm what your build actually captures, and how to keep the volume manageable.

Who authorises an insider investigation, what they must consider first, and what happens to the evidence when the step gets skipped.

Hunting is a skill set, not a headcount. Here is how to decide between building a team, buying the capability, or running a credible hybrid.

Beneath every function call sits a precise machine-level contract: where arguments go, where the return value comes back, and how the stack keeps it all straight. This post explains that contract.

Individual findings are dots. A host timeline is the line through them. Here is a lightweight way to order an intrusion on Linux, and spot faked timestamps.

Autopsy is a great forensic suite but there aren't a lot of good plugins for Linux evidence. We have tried to change this by creating some autopsy plugins directly aimed at things we find during Linux casework.

Self-hosted AI is now ordinary enterprise infrastructure. Investigating a compromised deployment turns out to be a Linux problem.

Most hunts fail before anyone queries anything, because the hypothesis was never testable. Here is how to write one that scopes the ground and reaches a conclusion.

Crime is a calculation. Here is why CPTED works - by shaping the offender's decision, raising effort and risk while lowering the reward.

SSH is how most Linux intrusions travel between hosts. This guide covers the artefacts it leaves behind, from appended authorised keys and hashed known_hosts entries to configuration changes used for persistence.

What separates an insider investigation from an intrusion investigation, and why the authorisation chain matters more than the toolkit.

Hunting is easy to justify to security people and hard to justify to a finance director. Here is how to build a case that survives the second conversation.

Effective crime reduction is usually a stack of small, cheap habits rather than one big purchase. Ten measures - most costing pounds, not thousands - that measurably cut risk within a month.

The stack is where programs keep return addresses, local variables and saved registers. Understanding push, pop and stack growth explains both everyday debugging and a whole class of attacks.