<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://securityartifacts.com/</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>daily</changefreq>
<priority>1</priority>
</url>
<url>
<loc>https://securityartifacts.com/start</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.95</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/threat-wire</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>hourly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/labs</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/labs/tools</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/techniques</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/library</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/feed</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/search</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://securityartifacts.com/observations</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/reference</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/artifacts</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.85</priority>
</url>
<url>
<loc>https://securityartifacts.com/resources</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/case-studies</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/corrections</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.85</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/playbooks</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/collect</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/hardening</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/event-ids</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/metrics</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/framework</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/community</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>daily</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/community/guidelines</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://securityartifacts.com/about</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/masthead</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/submissions</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/pricing</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/teams</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/legal/privacy</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.3</priority>
</url>
<url>
<loc>https://securityartifacts.com/legal/terms</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.3</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/impossible-travel-inbox-rule</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/domain-admin-from-a-workstation</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/moveit-transfer-webshell</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/log4shell-outbound-ldap</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/black-basta-before-the-encryption</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/business-email-compromise</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/insider-threat</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/ransomware-response</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/sigma-endpoint-pack</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/sigma-network-pack</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/yara-triage-samples</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/forensic-timeline-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/memory-forensics-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/windows-event-log-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/evidence-hash-manifest</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/linux-triage-collector</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/analysis-toolbox</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/timeline-merge</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries/rundll32-comsvcs-lsass-dump</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries/security-log-cleared</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/recipes</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/recipes/powershell-encodedcommand</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/first-15</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/first-15/lsass-credential-dump-alert</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/zoo</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/zoo/dns-long-labels</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/interview</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/interview/shimcache-proves-execution</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/timelines</loc>
<lastmod>2026-09-21T23:36:17.277Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/timelines/spray-to-exfil-demo</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-password-spray-4771</loc>
<lastmod>2026-09-21T21:57:20.307Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-psexec-lateral-7045</loc>
<lastmod>2026-09-21T21:57:23.884Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/guide-powershell-triage</loc>
<lastmod>2026-09-21T22:00:26.463Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-lsass-dump-comsvcs</loc>
<lastmod>2026-09-21T21:56:11.239Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-kerberoasting-4769</loc>
<lastmod>2026-09-21T21:55:52.678Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/guide-reading-4624</loc>
<lastmod>2026-09-21T21:57:22.302Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-02-the-proxy-only-kept-domains</loc>
<lastmod>2026-09-21T21:56:14.504Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/case-supply-chain-signed-update</loc>
<lastmod>2026-09-21T21:53:12.712Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/case-moveit-mass-exploitation</loc>
<lastmod>2026-09-21T21:54:08.188Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-03-the-shared-account</loc>
<lastmod>2026-09-21T21:56:13.341Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/timestomping-the-clock-they-forgot</loc>
<lastmod>2026-09-21T21:57:25.302Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/false-positive-hall-of-fame-01</loc>
<lastmod>2026-09-21T21:57:36.859Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-01-reimaged-on-tuesday</loc>
<lastmod>2026-09-21T21:59:32.829Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/cloud-identity-token-theft-pack</loc>
<lastmod>2026-09-21T21:54:21.575Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/report-kesterline-ransomware</loc>
<lastmod>2026-09-21T21:54:39.809Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-bec-oauth-consent</loc>
<lastmod>2026-09-21T21:56:26.089Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-evtx-no-vm</loc>
<lastmod>2026-09-21T21:56:27.979Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-build-and-break-a-disk-image</loc>
<lastmod>2026-09-21T21:59:37.040Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/observations-001</loc>
<lastmod>2026-09-21T21:56:30.114Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-service-persistence</loc>
<lastmod>2026-09-21T21:57:41.737Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-wmi-subscription-persistence</loc>
<lastmod>2026-09-21T22:59:58.223Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-northwind-intrusion</loc>
<lastmod>2026-09-21T21:53:21.225Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/what-is-mitre-attack</loc>
<lastmod>2026-09-21T21:59:43.780Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-scheduled-task-persistence</loc>
<lastmod>2026-09-21T21:57:39.186Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-run-key-persistence</loc>
<lastmod>2026-09-21T22:00:40.890Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/kev-batch-of-old-local-privesc</loc>
<lastmod>2026-09-21T22:00:43.644Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/gitea-diffpatch-git-hook-rce</loc>
<lastmod>2026-09-21T21:56:31.660Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/zimbra-smtp-command-injection</loc>
<lastmod>2026-09-21T21:57:53.225Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/q3-detection-rule-pack</loc>
<lastmod>2026-09-21T21:57:56.095Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/run-key-persistence-triage</loc>
<lastmod>2026-09-21T22:02:09.159Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/emulating-powershell-execution</loc>
<lastmod>2026-09-21T21:54:45.229Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/dns-tunnelling-pcap-walkthrough</loc>
<lastmod>2026-09-21T22:00:47.322Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-rebuild-detection-loop</loc>
<lastmod>2026-09-21T21:57:57.541Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
</urlset>
