Archive
Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to guide.
Event 4624 has more than twenty fields and most triage reads two of them. The five that change the conclusion, what each one is really recording, and the values that catch people out.
Most PowerShell alerts are administration. Five questions, ordered so the cheapest one that can close the alert comes first, with the answer that means stop and the answer that means keep going.
Timestomping is a decision, not an accident, and the decision is visible. NTFS keeps eight timestamps per file and the ordinary Windows API writes four of them. What the other four say about the tool the operator chose, the checklist they were working from, and where they stopped.
Chrome opens a pipe that Cobalt Strike also opens. Chrome's updater reads LSASS. Discord ships a signed binary that launches other binaries. Six alerts that fire on normal software, each with the benign explanation and the discriminator, and a count of how often the public rulebase admits any of this.
A beginner's guide to MITRE ATT&CK that does not open with the matrix. What it is, what it is not, why the giant grid is the worst way to meet it, and how to use it on a Tuesday afternoon rather than in a strategy deck.
A lab reconstruction of a user-level persistence case, and why the Run key timestamp is the least useful thing in the artifact set.
Four variants of the same PowerShell technique, three of which walked past a rule that looked fine on paper. Notes from a purple team afternoon.
Entropy, subdomain cardinality and query-rate shape. Three statistics that find a covert channel faster than any rule matching a known tool.
