<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://securityartifacts.com/</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>daily</changefreq>
<priority>1</priority>
</url>
<url>
<loc>https://securityartifacts.com/start</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.95</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/threat-wire</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>hourly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/labs</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/labs/tools</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/techniques</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/library</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/feed</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/search</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://securityartifacts.com/observations</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/reference</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/artifacts</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.85</priority>
</url>
<url>
<loc>https://securityartifacts.com/resources</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/case-studies</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/corrections</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.85</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/playbooks</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/collect</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/hardening</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/event-ids</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/metrics</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/framework</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/community</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>daily</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/community/guidelines</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://securityartifacts.com/about</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/masthead</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/submissions</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/pricing</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/teams</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/legal/privacy</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.3</priority>
</url>
<url>
<loc>https://securityartifacts.com/legal/terms</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.3</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/impossible-travel-inbox-rule</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/domain-admin-from-a-workstation</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/moveit-transfer-webshell</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/log4shell-outbound-ldap</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/black-basta-before-the-encryption</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/business-email-compromise</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/insider-threat</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/ransomware-response</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/sigma-endpoint-pack</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/sigma-network-pack</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/yara-triage-samples</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/forensic-timeline-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/memory-forensics-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/windows-event-log-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/evidence-hash-manifest</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/linux-triage-collector</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/analysis-toolbox</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/timeline-merge</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries/rundll32-comsvcs-lsass-dump</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries/security-log-cleared</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/recipes</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/recipes/powershell-encodedcommand</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/first-15</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/first-15/lsass-credential-dump-alert</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/zoo</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/zoo/dns-long-labels</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/interview</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/interview/shimcache-proves-execution</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/timelines</loc>
<lastmod>2026-09-22T21:23:09.142Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/timelines/spray-to-exfil-demo</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-kerberoasting-4769</loc>
<lastmod>2026-09-22T07:20:38.412Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-lsass-dump-comsvcs</loc>
<lastmod>2026-09-22T21:15:17.481Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-password-spray-4771</loc>
<lastmod>2026-09-22T07:20:37.892Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-psexec-lateral-7045</loc>
<lastmod>2026-09-22T07:20:16.377Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/guide-powershell-triage</loc>
<lastmod>2026-09-22T19:20:41.317Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/guide-reading-4624</loc>
<lastmod>2026-09-22T07:20:30.426Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/case-supply-chain-signed-update</loc>
<lastmod>2026-09-22T11:39:37.893Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/case-moveit-mass-exploitation</loc>
<lastmod>2026-09-22T07:20:23.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-03-the-shared-account</loc>
<lastmod>2026-09-22T13:36:21.332Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-02-the-proxy-only-kept-domains</loc>
<lastmod>2026-09-22T07:21:27.616Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-01-reimaged-on-tuesday</loc>
<lastmod>2026-09-22T07:21:03.916Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/false-positive-hall-of-fame-01</loc>
<lastmod>2026-09-22T07:21:12.387Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/timestomping-the-clock-they-forgot</loc>
<lastmod>2026-09-22T07:20:13.412Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/cloud-identity-token-theft-pack</loc>
<lastmod>2026-09-22T07:21:04.881Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/report-kesterline-ransomware</loc>
<lastmod>2026-09-22T07:20:20.361Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-bec-oauth-consent</loc>
<lastmod>2026-09-22T07:21:25.488Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-evtx-no-vm</loc>
<lastmod>2026-09-22T07:20:22.341Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-build-and-break-a-disk-image</loc>
<lastmod>2026-09-22T07:21:29.581Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/observations-001</loc>
<lastmod>2026-09-22T07:20:06.319Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-northwind-intrusion</loc>
<lastmod>2026-09-22T17:32:57.749Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-scheduled-task-persistence</loc>
<lastmod>2026-09-22T16:27:18.303Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-wmi-subscription-persistence</loc>
<lastmod>2026-09-22T07:20:02.286Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/what-is-mitre-attack</loc>
<lastmod>2026-09-22T07:20:59.435Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-service-persistence</loc>
<lastmod>2026-09-22T07:21:14.403Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-run-key-persistence</loc>
<lastmod>2026-09-22T07:20:58.424Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/gitea-diffpatch-git-hook-rce</loc>
<lastmod>2026-09-22T07:20:07.792Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/kev-batch-of-old-local-privesc</loc>
<lastmod>2026-09-22T07:21:10.893Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/zimbra-smtp-command-injection</loc>
<lastmod>2026-09-22T07:20:04.794Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/q3-detection-rule-pack</loc>
<lastmod>2026-09-22T07:20:17.878Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/run-key-persistence-triage</loc>
<lastmod>2026-09-22T07:20:44.428Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/emulating-powershell-execution</loc>
<lastmod>2026-09-22T17:23:42.731Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/dns-tunnelling-pcap-walkthrough</loc>
<lastmod>2026-09-22T18:14:47.541Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-rebuild-detection-loop</loc>
<lastmod>2026-09-22T17:53:18.968Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
</urlset>
