Archive
Every published post, by year.
2026
25 posts- 10 Sept What your EDR doesn't see: telemetry blind spots and the coverage you put on top
- 19 Aug Kerberoasting from the blue side: catching service-ticket abuse without drowning in 4769
- 19 Aug A Sysmon baseline that actually catches things in 2026
- 13 Aug Catching token theft with process-access telemetry, integrity jump and all
- 09 Aug Hunting malicious BITS jobs in 2026, and the log most people never turned on
- 05 Aug Tuning an abnormal child-process rule when you have no telemetry to tune against
- 01 Aug Designing a detection from the primitive up, not the tool down
- 28 Jul Registry Symbolic Links: The Quiet Redirect Sysmon Can Still See
- 24 Jul The System-Account Fingerprint of Files Pushed Over SMB
- 21 Jul Detecting lateral movement in 2026: what changed since the RDP-over-SSH era
- 20 Jul Hunting TeamViewer Abuse When the Tool Is Already Approved
- 16 Jul The ESENT Trail Left Behind When NTDS.dit Walks Out the Door
- 12 Jul The .NET CLR usage log: a per-tool execution receipt attackers forget about
- 08 Jul What Network Level Authentication does to your RDP hunt
- 04 Jul Named pipes as a C2 channel: hunting the pivot with Sysmon EID 17 and 18
- 29 Jun Scheduled tasks for persistence and remote execution: what to log, what to alert on
- 24 Jun Certutil as a downloader: catching the classic LOLBIN fetch
- 19 Jun Hunting the process that launched from a Run key or the Startup folder
- 14 Jun Event 4648 in practice: reading logon-with-explicit-credentials without chasing every runas
- 09 Jun The macro that never spawns a child of Word: detecting WMI and COM launches from Office
- 04 Jun RDP sourced from 127.0.0.1: catching remote desktop tunneled over reverse SSH
- 30 May When the endpoint can't see it: hunting from the Windows DNS server's analytical log
- 25 May Catching LSASS credential dumps that use ProcDump and Task Manager
- 20 May The child of explorer.exe nobody clicked: detecting DCOM lateral movement
- 15 May Catching a SharpHound run: the LDAP burst and the session fan-out