Categories

Detection-Development    ETW    Forensics    Reverse-Engineering    Threat-Hunting    Tools    eBPF    ios    Other   

Detection-Development

• Commandline Cloaking 2 - Tetragon and Nim

• SIEMCraft - Security detection monitoring using Minecraft

• Commandline Cloaking and Sysmon for Linux

• Using Python Bandit to find dodgy packages

ETW

• Gaining Threat-Intelligence the REALLY dodgy way

• ETW on Windows 11 - Initial thoughts

• Gaining Threat-Intelligence the dodgy way

• Experimenting with Protected Processes and Threat-Intelligence

• Getting more out of the Windows Filtering ETW Events

• Introducing Sealighter - Sysmon-Like research tool for ETW

Forensics

• Linux cloud memory forensics tutorial

Reverse-Engineering

• Tracking Windows Updates with Git and CI

• Experimenting with Ghidra Scripting

Threat-Hunting

• Hunting Sliver

• Hunting Koadic Pt. 2 - JARM Fingerprinting

• Hunting Koadic across Shodan

Tools

• Tool - Use TouchID and the Secure Enclave from the commandline

• Tool - Using AWS Lambdas to distribute WebRequests

• Tool - Create run VPNs in various clouds

• Tool - Use Terraform and Bitcoin to run VMs

eBPF

• DEF CON 29: Bad BPF - Warping reality using eBPF

• Detecting Kernel Hooking using eBPF

• Mapping It Out: Analyzing the Security of eBPF Maps

• Using eBPF to uncover in-memory loading

ios

• Investigating realtime detections on iOS using Unified Logging

Other