> all_blog_posts

What Actually Changes Hands When a SOC Case Escalates?

What Actually Changes Hands When a SOC Case Escalates?

An assignment-only record can't tell you whether the team asked for help or handed over the case

September 07, 2026

SOC Management Human Factors Incident Response
What a Remcos Configuration Report Can and Cannot Tell You

What a Remcos Configuration Report Can and Cannot Tell You

Reading two public config extractors side by side, and what the printed line leaves out

August 31, 2026

Malware Threat Intelligence Threat Analysis
What a Cobalt Strike Config Match Actually Buys You

What a Cobalt Strike Config Match Actually Buys You

Working a ten-row configuration match into a SOC handover

August 24, 2026

Malware Threat Intelligence Threat Analysis
Digging into a StealC Alert

Digging into a StealC Alert

Reading two HTTP signatures and one YARA rule alongside the documented protocol

August 17, 2026

Malware Stealers Threat Intelligence Threat Analysis
Tycoon 2FA and a Sneaky SVG

Tycoon 2FA and a Sneaky SVG

Low Effort Phishing Kits and Smaller Orgs

September 25, 2025

Phishing Stealers Threat Analysis
The Cyber Job Market: 2025

The Cyber Job Market: 2025

I graphed my job search

September 01, 2025

Strategy SOC Management General
No Malware Required: OAuth Token Abuse

No Malware Required: OAuth Token Abuse

How threat actors are weaponizing legitimate authentication flows for persistent cloud access

August 02, 2025

Incident Response O365 Threat Analysis
The Universal Cyber Incident Taxonomy (UCIT)

The Universal Cyber Incident Taxonomy (UCIT)

A Simple Cyber Event Labelling Schema That Actually Works

July 14, 2025

Incident Response SOC Management Strategy
It's ORBin' Time: Detecting Covert Relay Networks in Your Telemetry

It's ORBin' Time: Detecting Covert Relay Networks in Your Telemetry

Identifying which ORB Networks are Targeting You

July 07, 2025

Threat Hunting Infrastructure Tracking Threat Intelligence
Automating the Simple Blocks with Blackwall

Automating the Simple Blocks with Blackwall

Another Simple Auto-Refresh ASN Blocklist

July 01, 2025

Threat Hunting Infrastructure Tracking Threat Intelligence
East, Fast, Cheap Deception in the Cloud

East, Fast, Cheap Deception in the Cloud

Leveraging External IdP for Easy Honeynets

June 22, 2025

Threat Hunting Deception Tech Threat Intelligence
Catching North Koreans & Laptop Farms

Catching North Koreans & Laptop Farms

Detection Techniques for Farms on Your Network

June 13, 2025

Threat Intelligence Threat Hunting Threat Analysis
Deep Diving Amadey Source Code

Deep Diving Amadey Source Code

When C2 works both ways

March 25, 2025

Amadey Stealers Threat Analysis
A History of GraphAPI Attacks

A History of GraphAPI Attacks

Everybody's in the Cloud, particularly the attacker

February 07, 2025

O365 Tactic Tracking Threat Intelligence
C2 Redirector Usage and You

C2 Redirector Usage and You

A Blue Teamer's Guide to Obfuscated Command & Control

January 12, 2025

Command & Control Threat Hunting Infrastructure Tracking Threat Intelligence