<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://securityartifacts.com/</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>daily</changefreq>
<priority>1</priority>
</url>
<url>
<loc>https://securityartifacts.com/start</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.95</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/threat-wire</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>hourly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/labs</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/labs/tools</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/techniques</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/library</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/feed</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/search</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://securityartifacts.com/observations</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/reference</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/artifacts</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.85</priority>
</url>
<url>
<loc>https://securityartifacts.com/resources</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/case-studies</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/corrections</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.85</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/playbooks</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/collect</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/hardening</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/event-ids</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/metrics</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/framework</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/community</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>daily</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/community/guidelines</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://securityartifacts.com/about</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/masthead</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/submissions</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/pricing</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/teams</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/legal/privacy</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.3</priority>
</url>
<url>
<loc>https://securityartifacts.com/legal/terms</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.3</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/impossible-travel-inbox-rule</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/domain-admin-from-a-workstation</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/moveit-transfer-webshell</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/log4shell-outbound-ldap</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/black-basta-before-the-encryption</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/business-email-compromise</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/insider-threat</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/ransomware-response</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/sigma-endpoint-pack</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/sigma-network-pack</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/yara-triage-samples</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/forensic-timeline-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/memory-forensics-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/windows-event-log-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/evidence-hash-manifest</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/linux-triage-collector</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/analysis-toolbox</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/timeline-merge</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries/rundll32-comsvcs-lsass-dump</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries/security-log-cleared</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/recipes</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/recipes/powershell-encodedcommand</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/first-15</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/first-15/lsass-credential-dump-alert</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/zoo</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/zoo/dns-long-labels</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/interview</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/interview/shimcache-proves-execution</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/timelines</loc>
<lastmod>2026-09-21T20:28:38.386Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/timelines/spray-to-exfil-demo</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-password-spray-4771</loc>
<lastmod>2026-09-21T19:43:03.989Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/guide-reading-4624</loc>
<lastmod>2026-09-21T19:03:21.892Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-psexec-lateral-7045</loc>
<lastmod>2026-09-21T17:22:31.470Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-lsass-dump-comsvcs</loc>
<lastmod>2026-09-21T19:03:53.357Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/guide-powershell-triage</loc>
<lastmod>2026-09-21T19:03:44.483Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-kerberoasting-4769</loc>
<lastmod>2026-09-21T19:03:46.105Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-03-the-shared-account</loc>
<lastmod>2026-09-21T16:08:47.783Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/case-moveit-mass-exploitation</loc>
<lastmod>2026-09-21T18:17:21.085Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/case-supply-chain-signed-update</loc>
<lastmod>2026-09-21T16:08:47.450Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-02-the-proxy-only-kept-domains</loc>
<lastmod>2026-09-21T16:08:48.468Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-01-reimaged-on-tuesday</loc>
<lastmod>2026-09-21T16:08:48.850Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/false-positive-hall-of-fame-01</loc>
<lastmod>2026-09-21T16:08:49.264Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/timestomping-the-clock-they-forgot</loc>
<lastmod>2026-09-21T16:08:49.823Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/cloud-identity-token-theft-pack</loc>
<lastmod>2026-09-21T16:08:50.074Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/report-kesterline-ransomware</loc>
<lastmod>2026-09-21T16:08:51.902Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-evtx-no-vm</loc>
<lastmod>2026-09-21T16:08:50.357Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/observations-001</loc>
<lastmod>2026-09-21T16:08:50.756Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-bec-oauth-consent</loc>
<lastmod>2026-09-21T16:08:51.593Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-build-and-break-a-disk-image</loc>
<lastmod>2026-09-21T16:08:51.126Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-service-persistence</loc>
<lastmod>2026-09-21T16:08:52.869Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-northwind-intrusion</loc>
<lastmod>2026-09-21T16:08:52.543Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-scheduled-task-persistence</loc>
<lastmod>2026-09-21T16:08:53.951Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-wmi-subscription-persistence</loc>
<lastmod>2026-09-21T18:19:45.553Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/what-is-mitre-attack</loc>
<lastmod>2026-09-21T17:43:50.522Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-run-key-persistence</loc>
<lastmod>2026-09-21T16:08:53.476Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/gitea-diffpatch-git-hook-rce</loc>
<lastmod>2026-09-21T16:08:55.377Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/kev-batch-of-old-local-privesc</loc>
<lastmod>2026-09-21T16:08:54.722Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/zimbra-smtp-command-injection</loc>
<lastmod>2026-09-21T16:08:55.026Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/q3-detection-rule-pack</loc>
<lastmod>2026-09-21T16:08:55.823Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/run-key-persistence-triage</loc>
<lastmod>2026-09-21T16:08:56.125Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/emulating-powershell-execution</loc>
<lastmod>2026-09-21T16:08:56.412Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/dns-tunnelling-pcap-walkthrough</loc>
<lastmod>2026-09-21T16:36:43.391Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-rebuild-detection-loop</loc>
<lastmod>2026-09-21T17:41:04.502Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
</urlset>
