Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to atomic-red-team.

AnalysisMembers

Emulating T1059.001 until the detection actually fires

Four variants of the same PowerShell technique, three of which walked past a rule that looked fine on paper. Notes from a purple team afternoon.

Full write-up available to members subscribers. See what is included.