Baraa Mohamed·Just nowInside Volt Typhoon: Reconstructing an APT Attack Through SplunkFrom Account Compromise to Command and Control — A SOC Investigation
Vaibhav·3d agoWe Built a Pipeline That Detonates Malware, Maps It to MITRE ATT&CK, and Ranks CVEs — AutomaticallyOne command. One suspicious file. A full threat intelligence report on the other side.
Praise Ameh·5d agoCyberDefenders — Phantom Installer Lab WriteupWelcome to my Phantom Installer writeup.
Furqan P.·Nov 3MITRE ATT&CK v20 Is Here: AI Attacks Are Changing the Cybersecurity LandscapeFrom prompt injection and AI-enabled data theft to attacks on critical infrastructure, MITRE’s latest update highlights how the threat…
ivan ninichuck·Nov 1Advanced TIE (Part 1): Predicting the Adversary’s Next MoveStandardizing adversary tradecraft through MITRE ATT&CK gave the security community a foundational language to categorize behaviors…
ivan ninichuck·Nov 1Advanced TIE (Part 2): Inside the Spiking World ModelNote: This is Part 2 of a two-part series on the Advanced Technique Inference Engine (Advanced TIE). In Advanced TIE (Part 1): Predicting…
rebootingdaily·Oct 26Entry 2: Testing SSH detection rules with wazuh-logtest (simulated)Summary: I used wazuh-logtest to feed three made-up SSH log lines to Wazuh’s ruleset and see how each was decoded and scored. This was a…
edgar·Oct 26Simulating attacks with Atomic Red Team and mapping to MITRE ATT&CK (Part 3)Part 3 of the Sentinel lab series. Part 2 covered writing a detection rule for RDP brute force (T1110).
Abdulrahman Heza·Oct 25OSINT — MITRE (3) Lab | Incident Response & Threat Hunting WalkthroughIn this writeup, we will solve the OSINT — MITRE (3) challenge on Cyber Haze. The lab focuses on analyzing threat scenario text and mapping…
GUNASEELAN·Oct 245 Mistakes I Made Building My First Detection Rule (So You Don’t Have To Make Them First)Nobody tells you how uncomfortable it is to stare at a blank rule editor.
