Introduction
In today’s post we’re going to create detections and hunt for the usage of the recent lateral movement technique called SCShell.
[Read More]
Streamlining BloodHound Analytics
Jupyter all the things
Introduction
[Read More]
Not All Paths are Created Equal
Attackers' Economy (Part 1)
Introduction
[Read More]
Hunting for Suspicious LDAP Activity with SilkETW and Yara
Detecting Active Directory Enumeration
Intro
This is another post to document my journey of learning Threat Hunting. In today’s post we’re going to perform threat hunting activities with the aim of hunting for AD domain enumeration.
[Read More]
Hunting for Anomalous Usage of MSBuild and Covenant
Today’s post will cover some of my experiments while practicing threat hunting. Specifically today we will cover hunting for malicious usage of msbuild.exe used by Covenant.
[Read More]