Rich·Apr 2Finding Common Evasion TTPs in PowerShell LogsTL;DR We tested out the MSBuildShell and PowerLess, two common TTPs to run PowerShell and PS1s without PowerShell.exe and then queried the…
Rich·Mar 27Enabling PowerShell ScriptBlock and Transcript LoggingTL;DR Disabling LLMNR, mDNS, & NetBIOS, require SMB Signing, enabling Sysmon, and enabling both PowerShell Script Block and Transcript…A response icon1A response icon1
InInfosecPandeybyInfosecPandey·Jun 17, 2025How to Use Event Logs to Catch Data Exfiltration in ActionScene: It’s 3:00 AM in the SOC.
Yousef·May 6, 2024BlueSky Ransomware Blue Team LabQ1: Knowing the source IP of the attack allows security teams to respond to potential threats quickly. Can you identify the source IP…
Tokenview.io·Apr 7, 2024Monitoring Ethereum Event Topics for Developers Using Tokenview APIDevelopers often need to monitor specific event topics on the Ethereum blockchain to track relevant smart contract interactions and…
InMirko Peters — Data & Analytics BlogbyMirko Peters - Microsoft MVP·Mar 8, 2024Understanding the Distinction: Process Mining vs Data Mining and Their Impact on BusinessIn the contemporary business landscape, the terms “process mining” and “data mining” are often mentioned in discussions surrounding…
LetMeDayDream·Mar 4, 2024Know EDR before evasion (2)The previous article described the general principles of EDR. In this chapter we wrote a FakeEDR to try to identify malware Villain.
