Analysis
Finding DNS tunnelling in a 4 GB capture without a signature
Entropy, subdomain cardinality and query-rate shape. Three statistics that find a covert channel faster than any rule matching a known tool.
T1048.003T1071.004
Archive
Research
Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to zeek.
Collection
Format
Lab Note
Rebuilding the lab around the feedback loop, not the tooling
Six months of a detection lab that was impressive to look at and useless to work in, and the four changes that fixed it.