PinnedTelemetry on Linux vs. Windows: A Comparative AnalysisA look at how Windows and Linux manage telemetry to support incident response operations.Sep 3, 2024Sep 3, 2024
Fake reCAPTCHA Phishing: When Good Intentions Go WrongPhishing attacks are constantly evolving, and techniques like ClickFix and fake reCAPTCHA phishing have been on the rise. These scams…Feb 22Feb 22
2024 in Review: Helping InfoSec Professionals Achieve Their GoalsKey Lessons for Building InfoSec Careers and Navigating the Cybersecurity LandscapeDec 27, 20241Dec 27, 20241
EDR Telemetry Project: Exciting New Updates and InsightsExplore the latest EDR Telemetry Project updates: new integrations, refined telemetry, community growth, and an upcoming Linux release! 🚀Dec 13, 2024Dec 13, 2024
My Favourite Security-focused GPO: Stopping Script Execution with File AssociationsSome time ago, I stumbled upon an excellent post by Red Canary[1] that introduced a clever method to prevent users from accidentally…Nov 4, 2024Nov 4, 2024
Published inDetect FYIUnintentional Evasion: Investigating How CMD Fragmentation Hampers Detection & ResponseDiscover how CMD command fragmentation creates security blind spots, letting attackers evade detection and complicate investigations.Oct 3, 2024Oct 3, 2024
Behind the Scenes: The Daily Grind of Threat HunterI turned a Twitter thread into a blog post on the topic of threat hunting. This is an example of the real-world steps involved during a…Nov 29, 20231Nov 29, 20231
Published inInfoSec Write-upsUnderstanding Red to Be Better at Blue: Navigating New CrackMapExec UpdatesHow to research and develop detection and hunting techniques based on new features from commonly-used penetration testing frameworks.Sep 5, 2023Sep 5, 2023
Threat Hunting Metrics: The Good, The Bad and The UglyThreat hunting is a crucial aspect of information security, but measuring its effectiveness can be challenging. In this article, we will…Aug 21, 20233Aug 21, 20233
Public Opinion Survey Results: You’re PwnedI am starting these short-form blog posts that aim to provide insights into attackers’ actions once they gain access to a network. Although…Jul 5, 2023Jul 5, 2023
Published inDetect FYIEDR Telemetry Project: A Comprehensive ComparisonEndpoint Detection and Response (EDR) products have become essential to organizations’ cybersecurity strategies. As a result, understanding…Apr 19, 20238Apr 19, 20238
Published inDetect FYIThreat Hunting Series: Detection Engineering VS Threat HuntingThreat hunting is becoming mainstream, and despite the attention it receives, many people need help to differentiate it from other roles…Feb 21, 20232Feb 21, 20232
Published inInfoSec Write-upsThreat Hunting Series: Using Threat Emulation for Threat HuntingThis post will demonstrate how threat emulation can be used for threat hunting. I often use threat emulation to understand the evidence an…Oct 10, 20222Oct 10, 20222
Published inInfoSec Write-upsThreat Hunting Series: The Threat Hunting ProcessIn the previous posts of the series, I covered the basics of threat hunting and the core competencies a threat hunter should haveJul 18, 20222Jul 18, 20222
Threat Hunting Series: What Makes a Good Threat HunterContinuing with the second post in this series, I felt it was necessary to address the skills and knowledge required to become a threat…Jun 27, 20221Jun 27, 20221
Threat Hunting Series: The BasicsThis first post on Threat Hunting goes over the basics. What is threat hunting, what are some common misconceptions, what are the goals…Jun 12, 2022Jun 12, 2022
Busting the myth that security teams must get it right 100% of the time when attackers only have to…DisclaimerJul 21, 2021Jul 21, 2021
High-Level Threat Intelligence Playbooks: Intrusion Analysis PlaybookIntrusion analysis based on a set methodologyMar 6, 2021Mar 6, 2021