<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://securityartifacts.com/</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>daily</changefreq>
<priority>1</priority>
</url>
<url>
<loc>https://securityartifacts.com/start</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.95</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/threat-wire</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>hourly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/labs</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/labs/tools</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/techniques</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/library</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/feed</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/search</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://securityartifacts.com/observations</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>https://securityartifacts.com/reference</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/artifacts</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.85</priority>
</url>
<url>
<loc>https://securityartifacts.com/resources</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/case-studies</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/corrections</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.85</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/playbooks</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/collect</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/hardening</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/event-ids</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/metrics</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/framework</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/community</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>daily</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/community/guidelines</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://securityartifacts.com/about</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/masthead</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/submissions</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://securityartifacts.com/pricing</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://securityartifacts.com/teams</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/legal/privacy</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.3</priority>
</url>
<url>
<loc>https://securityartifacts.com/legal/terms</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.3</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/impossible-travel-inbox-rule</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/domain-admin-from-a-workstation</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/moveit-transfer-webshell</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/log4shell-outbound-ldap</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/tabletop/black-basta-before-the-encryption</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/business-email-compromise</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/insider-threat</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/playbooks/ransomware-response</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/sigma-endpoint-pack</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/sigma-network-pack</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/rules/yara-triage-samples</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/forensic-timeline-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/memory-forensics-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/references/windows-event-log-cheat-sheet</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/evidence-hash-manifest</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/linux-triage-collector</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/analysis-toolbox</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/library/tools/timeline-merge</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries/rundll32-comsvcs-lsass-dump</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/queries/security-log-cleared</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/recipes</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/recipes/powershell-encodedcommand</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/first-15</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/desk/first-15/lsass-credential-dump-alert</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/zoo</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/zoo/dns-long-labels</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/interview</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/interview/shimcache-proves-execution</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/timelines</loc>
<lastmod>2026-09-23T19:38:04.078Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/learn/timelines/spray-to-exfil-demo</loc>
<lastmod>2026-09-21T00:00:00.000Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.75</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-lsass-dump-comsvcs</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/guide-powershell-triage</loc>
<lastmod>2026-09-23T15:27:21.952Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/guide-reading-4624</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-psexec-lateral-7045</loc>
<lastmod>2026-09-23T12:16:04.902Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-kerberoasting-4769</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-password-spray-4771</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/case-moveit-mass-exploitation</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-03-the-shared-account</loc>
<lastmod>2026-09-23T11:52:08.382Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-02-the-proxy-only-kept-domains</loc>
<lastmod>2026-09-23T10:15:51.501Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/case-supply-chain-signed-update</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/evidence-gap-01-reimaged-on-tuesday</loc>
<lastmod>2026-09-23T19:23:21.072Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/timestomping-the-clock-they-forgot</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/false-positive-hall-of-fame-01</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/cloud-identity-token-theft-pack</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/observations-001</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/report-kesterline-ransomware</loc>
<lastmod>2026-09-23T13:58:56.457Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-build-and-break-a-disk-image</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-bec-oauth-consent</loc>
<lastmod>2026-09-23T16:42:41.577Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-evtx-no-vm</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-scheduled-task-persistence</loc>
<lastmod>2026-09-23T18:12:11.192Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-service-persistence</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-constructed-northwind-intrusion</loc>
<lastmod>2026-09-23T16:59:14.494Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-wmi-subscription-persistence</loc>
<lastmod>2026-09-23T12:23:02.237Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/what-is-mitre-attack</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-run-key-persistence</loc>
<lastmod>2026-09-23T12:47:11.379Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/kev-batch-of-old-local-privesc</loc>
<lastmod>2026-09-23T11:43:17.518Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/zimbra-smtp-command-injection</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/gitea-diffpatch-git-hook-rce</loc>
<lastmod>2026-09-23T14:13:24.195Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/q3-detection-rule-pack</loc>
<lastmod>2026-09-23T13:33:14.414Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/run-key-persistence-triage</loc>
<lastmod>2026-09-23T17:36:32.704Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/emulating-powershell-execution</loc>
<lastmod>2026-09-23T12:54:04.227Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/dns-tunnelling-pcap-walkthrough</loc>
<lastmod>2026-09-23T10:07:29.364Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://securityartifacts.com/posts/lab-rebuild-detection-loop</loc>
<lastmod>2026-09-23T17:05:56.612Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
</urlset>
