Technical articles on threat hunting, KQL/Sentinel detection, pentesting and incident response. No fluff: queries and procedures I actually use.
You don't need to watch 400 event types: you need the right ones. The Windows Event IDs that tell the story of an attack —logon, privileges, persistence, log clearing, PowerShell and Sysmon— and what to hunt with each.
Read article →A CVE advisory tells you what breaks, not how to detect it. The method to go from an advisory to a detection: service and ports, event IDs, ATT&CK tactic and a Sigma rule skeleton.
Read article →Reading a regular expression token by token, and the trap that turns an innocent validation into a DoS: catastrophic backtracking (ReDoS). How to spot it and avoid it.
Read article →A Dockerfile that works is not a secure Dockerfile. The anti-patterns a linter checks —root, :latest, secrets in ENV, curl|sh, privileged, hostPath— and how to fix them.
Read article →Nmap has dozens of options, but a good scan comes down to six decisions: which hosts, which ports, how to probe them, how much to find out, at what pace and how to save it. Understand the flags that matter (and only use them where you have permission).
Read article →YARA is the "grep" of malware analysis: rules that describe a family by its strings and bytes. The anatomy of a rule (meta, strings, condition), modifiers and how to write one that catches variants without firing on legitimate software.
Read article →Renaming an .exe to .jpg does not make it an image. A file's first bytes —its signature or "magic bytes"— reveal its real format. Why it matters in forensics, file uploads and CTF, and how to check it.
Read article →Number 1 on the OWASP Top 10 for LLMs: a user reprograms your chatbot with a sentence. The four ways to hijack it, why it is so hard to stop and how to defend your system prompt.
Read article →A blocklist WAF is a speed bump, not a wall: it chases strings, not semantics. The four classic bypasses (XSS without <script>, encoding, comments/case and double encoding) and why a WAF is a layer, not the fix.
Read article →You commit an API key by mistake, delete it in the next commit and relax. Don't: it stays in history. Why it happens, why rotating (not deleting) comes first, and how to prevent it.
Read article →A JWT is readable without a key (it is not encrypted). The three flaws that turn it into full compromise: alg:none, weak HMAC secret and algorithm confusion (RS256→HS256). How they are exploited and how to defend.
Read article →A KQL detection only works for Sentinel. With Sigma you write it once in YAML and convert it to KQL, SPL, Elastic or Wazuh. Rule anatomy, from log to rule, and how to avoid drowning in false positives.
Read article →You decommission a service but the CNAME keeps pointing at it; an attacker claims it and takes over your subdomain for phishing. How it happens, how to hunt it with recon and how to close it from the defense side.
Read article →CVSS v4.0 is not a tweak of v3.1: it changes the impact model (vulnerable vs subsequent systems), splits complexity from attack requirements and reworks threat, environmental and supplemental groups. What each new metric means and the common scoring mistakes.
Read article →The rookie mistake in a CTF (and in malware triage): confusing encoding with encryption. How to tell encoding, encryption and hashing apart, recognize Base64/hex/ROT by shape and chain decodings.
Read article →Before touching a target, an attacker reads it from public sources without sending a single packet: DNS, Certificate Transparency, WHOIS, Wayback, Shodan. What your domain reveals and how to shrink that surface.
Read article →Cron is legit, everywhere and quiet: which makes it a nest for persistence. Where attackers hide, the patterns that give a malicious job away, and how to enumerate and watch every crontab.
Read article →You just caught a reverse shell and it is "dumb": no tab-completion, no history, Ctrl-C kills it. How to get a full TTY (pty, stty, socat) and how the Blue Team detects it.
Read article →Most CSPs are useless (with unsafe-inline) or break the site. How to build a strict nonce-based CSP, the directives that matter, and how to roll it out without surprises.
Read article →A method to avoid drowning in alerts: validate, enrich, scope and decide. The steps and tools to go from "an alert fires" to "I know what to do".
Read article →SSH default config is a magnet for brute force. Keys instead of passwords, no root, 2FA, modern ciphers and monitoring, step by step.
Read article →CVSS alone is not enough to prioritize patching. How to combine EPSS (exploit probability), CISA's KEV list and your real exposure to patch what matters.
Read article →A triage guide for a suspicious email without opening links or attachments: headers, SPF/DKIM/DMARC authentication, sender, URLs, IOCs and how to report it.
Read article →A practical guide to setting up email authentication (SPF, DKIM and DMARC) in the right order, with the common mistakes and how to verify it all.
Read article →Practical setup of Defender for Office 365, Conditional Access and email authentication (SPF/DKIM/DMARC), in the order I would apply them.
Read article →Three KQL signals (entropy, volume and record types) to hunt DNS exfiltration and C2, and how to turn them into an analytics rule.
Read article →I'll email you when I publish a new tool or article. No spam, unsubscribe anytime.
>_ More articles coming soon…