Using Memory Analysis to Detect EDR-Nullifying Malware

Abuse and Detection of M365D Live Response for privilege escalation on Control Plane (Tier0) assets

It’s Time to Break the SOC Analyst Burnout Cycle

Uncovering Windows Events

Writing Your Own Ticket to the Cloud Like APT: A Dive to AD FS Attacks, Detections, and Mitigations

SpAML: Spoofing Users in Azure AD With SAML Claims Transformations

The Bicycle of the Forensic Analyst

Fuzzy hashing logs to find malicious activity

Logging strategies for security incident response

Mastering Email Forwarding Rules in Microsoft 365

Ransomware in the cloud

Using Azurehound to Identify Azure Attack Paths by Kevin Mwanjumwa

AWS Cloud Log Extraction

These Are The Drivers You Are Looking For: Detect and Prevent Malicious Drivers

Is your antivirus really secure? Testing Powershell payload obfuscated with Chimera

Hunting & Detecting SMB Named Pipe Pivoting (Lateral Movement)

Welcome 👋 Microsoft Extractor Suite

Exploring Impersonation through the Named Pipe Filesystem Driver

Detecting and decrypting Sliver C2 – a threat hunter’s guide

AppDomain Manager Injection: New Techniques For Red Teams

Living Off The Land Drivers 1.0 Release: New Features, Enrichments, and Community Contributions

Trucking on with DotDumper

From on-prem to Global Admin without password reset

Advanced threat hunting within Active Directory Domain Services - Knowledge is power!

Tampering with Conditional Access Policies Using Azure AD Graph API

Quasar Rat Analysis - Identification of 64 Quasar Servers Using Shodan and Censys

Unmasking Ransomware Using Stylometric Analysis: Shadow, 8BASE, Rancoz

Hunting Malicious Infrastructure using JARM and HTTP Response

Don't @ Me: URL Obfuscation Through Schema Abuse

Avoiding Consent to MS Graph PowerShell with Azure CLI: A Step Towards Simpler Operations and Adversary Simulation

Hunting Malicious Infrastructure using JARM and HTTP Response

Don't @ Me: URL Obfuscation Through Schema Abuse

Is Cloud Forensics just Log Analysis? Kind Of.

SIM Swapping and Abuse of the Microsoft Azure Serial Console: Serial Is Part of a Well Balanced Attack

Advanced threat hunting within Active Directory Domain Services - Knowledge is power!

Living Off The Land Drivers 1.0 Release: New Features, Enrichments, and Community Contributions

Trucking on with DotDumper

Avoiding Consent to MS Graph PowerShell with Azure CLI: A Step Towards Simpler Operations and Adversary Simulation

The Bicycle of the Forensic Analyst

Hunting Malicious Infrastructure using JARM and HTTP Response

Is Cloud Forensics just Log Analysis? Kind Of.

Unmasking Ransomware Using Stylometric Analysis: Shadow, 8BASE, Rancoz