About
Security Artifacts
Incident teardowns, detection engineering and adversary emulation, plus an automated wire of active exploitation and vulnerability disclosure.
Security Artifacts publishes incident teardowns, detection engineering notes and adversary emulation work, plus an automated wire of active exploitation and vulnerability disclosure.
Everything here is lab work or a public case reconstructed from public evidence. No client data, no employer's telemetry, no exceptions. That constraint is a feature, because it means every artifact can be published in full rather than sanitised into uselessness.
What is free and what is not
The Threat Wire is free and stays free. It aggregates other people's public reporting and CISA and NIST open data; charging for a link to that would be both wrong and pointless.
What members pay for is the work on top: the members-only teardowns and labs, the detection-rule packs with tuning notes on every rule, the full artifact reference rather than the execution half of it, and downloadable artifacts.
Two things that belong in that list are not in it yet, and saying so here is cheaper than being found out: the analyst assessments on Threat Wire entries, and IOC sets fuller than the ones published so far. Where a page would gate one of those, it checks whether the assessment actually exists first, so nothing is ever sold behind a door with an empty room behind it. The pricing page counts what is really there.
What we collect
No analytics, no tracking pixels, no advertising network. If you only read, the site keeps nothing about you beyond an ordinary server log. If you sign in, it stores your email so it can identify you, and whatever else you choose to add.
One thing is worth stating here rather than only in the notice: setting a public handle publishes a profile page with your display name, headline and posts on it. Your email is never on that page. Members without a handle do not appear publicly at all. The privacy notice has the detail.
Our methodology
The reason to read this rather than to ask a model is that you can see exactly how much of each page somebody ran and watched. Every piece carries one of two labels, set in its source file and rendered on the page, never typed into the prose where it could be left out.
REAL means the artifacts, registry keys, event IDs and on-disk traces came out of an execution we performed and observed on the bench described below, or from a real incident documented in a primary source we cite.
CONSTRUCTED means the piece was drafted to teach. The organisation, the people, the hosts and the log lines are invented, and a banner on the page names which parts are real: the technique, the event IDs, the fields and the sources. Some constructed pieces are drafted with the help of automation, including a language model; those are marked in their source as generated, can never be labelled REAL, and every technique identifier and cited source in them is checked by a machine against MITRE and against the live page before they publish. Hunting queries, rules, recipes and checklists also say whether they have been run: untested, syntax checked, run in a lab, or run in production.
For REAL pieces, the bench is a dedicated Windows 11 Enterprise virtual machine on an isolated host-only network, restored from a clean snapshot before each run. Sysmon and full command-line auditing are on. We take the snapshot, detonate the sample or run the technique, and then diff the machine against its own clean state: registry, filesystem, event log, services, scheduled tasks, and prefetch. What survives the diff is what gets written up, and it is written up with the version numbers and build it was observed on, because an artifact that appears on one build and not the next is a fact about that build.
Anything we could not reproduce is either left out or labelled as unverified in the text. Where a claim comes from someone else’s reporting rather than from our bench, it is cited as theirs. When a later build changes an artifact, the page is corrected and the change is recorded in the corrections ledger rather than edited away quietly.
Licensing
Posts are CC BY 4.0. Detection rules, queries and IOC lists are CC0, which means public domain and no attribution needed, even for members-only content once you have it. A rule with a licence attached is a rule nobody deploys.
Colophon
Next.js on Vercel, PostgreSQL and authentication on Supabase, billing through Stripe. No analytics, no tracking pixels, no advertising network, and nothing that profiles you.
One third-party script does load, on every page, and it is easier to name it than to claim a purity the network tab would contradict: Cloudflare Turnstile, at challenges.cloudflare.com. It is the thing standing between the sign-in form and a bot filling it a thousand times a minute, and between the newsletter form and a list full of addresses that never asked to be on it. Turnstile is a CAPTCHA replacement rather than an analytics product: it decides whether a submission came from a person. If you would rather it did not run, blocking that host leaves everything except the two forms working normally.
Beyond that, the only outbound request a page makes is to the database it is reading from. Card details go to Stripe and are never handled by this site.