Practical cybersecurity articles covering security operations, threat detection, defensive security, vulnerabilities, and real-world security engineering.
32articles published
An introduction to process creation logs, explaining how operating systems record executable activity and how security analysts use this data to spot suspicious behavior.
An in-depth guide to detecting DCSync attacks through Windows Event Log 4662, RPC network traffic, and identity telemetry while managing operational false positives.
Learn how adversaries exploit Windows DLL loading mechanisms to execute code through trusted binaries, and how to build targeted detections using Sysmon and EDR telemetry.
Learn how the Domain Name System (DNS) works, how attackers abuse it to communicate with infected devices or steal data, and how security analysts spot suspicious domain activity.
An in-depth technical analysis of how attackers evade task enumeration by manipulating TaskCache registry structures, modifying SDDLs, and bypassing standard API logging, along with strategies for high-fidelity detection engineering.
An in-depth analysis of how advanced threat actors bypass user-mode EDR hooks using direct and indirect system calls, how call stack spoofing defeats stack trace analysis, and how detection engineers can build robust detections using ETW-Ti and unbacked memory telemetry.
A practical guide to understanding Kerberoasting mechanics, analyzing Windows Event ID 4769 telemetry, and building detection rules that filter out domain noise.
Learn how email headers work, how to trace an email's true path, and how authentication protocols like SPF, DKIM, and DMARC spot phishing attempts.
An in-depth technical analysis of how adversaries manipulate process metadata through PPID spoofing and PEB command-line modification, paired with detection strategies using kernel telemetry and process access events.
A practical guide to hunting and detecting Windows Remote Management (WinRM) lateral movement using process lineage, Windows Event Logs, and network correlation.
Learn what Multi-Factor Authentication (MFA) is, how attackers attempt to bypass it, and how security analysts detect MFA-related attacks.
An in-depth technical analysis of process reflection and PSS API-based LSASS memory dumping, focusing on EDR telemetry gaps, GrantedAccess bitmask auditing, and practical detection logic.
An operational breakdown of how attackers blind user-mode Event Tracing for Windows, telemetry gaps in security stack monitoring, and strategies for detecting in-memory byte modifications.
A practical guide to hunting and detecting malicious WMI execution and lateral movement across Windows environments using host logs and network telemetry.
Learn how Windows records security events, which Event IDs matter most for defenders, and how security analysts use logs to detect unauthorized activity.
A practical guide to analyzing Windows scheduled task persistence, understanding event log telemetry, detecting API-based task creation, and identifying stealth techniques like hidden registry tasks.
A beginner's guide to understanding how programs run, what command-line logs show, and how defenders detect malicious commands on endpoint systems.
An operational deep dive into detecting offline NTDS.dit extraction using Windows Security Event logs, ESENT engine telemetry, Volume Shadow Copy auditing, and raw volume access artifacts.
Learn how DCSync abuses Active Directory replication protocols to extract credential hashes and how to detect it using Event ID 4662 and RPC telemetry.
Learn the differences between brute force and password spraying attacks, how to analyze authentication logs, and practical steps to defend user accounts.
An in-depth analysis of Parent Process ID (PPID) spoofing, examining how Win32 API process creation attributes operate, where standard process logs fall short, and how kernel telemetry resolves discrepancies.
A practical guide to understanding Kerberoasting mechanics, auditing Event ID 4769 telemetry, detecting downgrade requests, and implementing honey SPNs in Active Directory.
Learn how the Domain Name System works, why DNS telemetry is crucial for defenders, and how to spot suspicious network activity using query logs.
An in-depth technical analysis of how adversaries manipulate process parameters within the Process Environment Block (PEB) to bypass command-line logging, along with strategies for surfacing this tradecraft using kernel callbacks and ETW.
Learn how threat actors exploit Windows DLL search order to execute malicious code through legitimate binaries, and how to build targeted detections without overwhelming your SIEM.
Learn how email headers work, how to trace an email's path across the internet, and how to verify sender authenticity using SPF, DKIM, and DMARC.
An advanced technical breakdown of Bring Your Own Vulnerable Driver (BYOVD) tactics, driver load telemetry, detection logic using KQL, and engineering controls to prevent EDR blinding.
A practical guide to detecting credential dumping against LSASS using Sysmon Event ID 10, Windows Security Auditing, and access mask telemetry.
Learn how Windows logs user authentications, what Logon Types mean, and how to spot suspicious login activity using Event IDs 4624 and 4625.
An in-depth analysis of msDS-KeyCredentialLink exploitation, Directory Service event correlation, and detection logic for PKINIT-based persistence.
A deep dive into the mechanics of Remote Procedure Call (RPC) coercion attacks, examining kernel and endpoint telemetry streams to build high-fidelity detections beyond standard authentication logs.
A practical guide to understanding DCSync mechanics, configuring Active Directory audit policies, and writing high-fidelity detections using Windows Security Event logs and RPC network telemetry.