PinnedInFalconForcebyOlaf Hartong·Nov 10, 2023FalconHound, attack path management for blue teamsRecently at Wild West Hackin Fest, I spoke about a powerful new tool we’ve been working hard on and now is available to the public…A response icon1A response icon1
PinnedOlaf Hartong·Jun 27, 2023Sysmon 15.0 — File executable detectedSysmon 15 has just been released and has received several bug fixes, one among them which could prevent a machine from booting while…A response icon1A response icon1
Olaf Hartong·Sep 18Sysmon Modular, a new toolkit for building and tuning your configurationMany updates, new tooling explained
InFalconForcebyOlaf Hartong·Aug 26I’m in your logs now: deceiving analysts and blinding EDRsIntroductionA response icon1A response icon1
InFalconForcebyOlaf Hartong·Nov 20, 2025Microsoft Defender for Endpoint Internal 0x06 — Custom CollectionMicrosoft recently published a new feature for Defender for Endpoint (MDE) called Custom Collection. At FalconForce, we've had the great…
InFalconForcebyOlaf Hartong·Dec 16, 2024Detection engineering rabbit holes — parsing ASN.1 packets in KQLTL;DR: Detection engineering is sometimes hard. Your efforts may seem to have failed, but perseverance can pay off. Or you can still fail…
InFalconForcebyOlaf Hartong·Oct 13, 2023Microsoft Defender for Endpoint Internals 0x05 — Telemetry for sensitive actionsIn the previous edition of this series I discussed the Timeline telemetry. Since that blog the amount of events has certainly grown. I’ve…
InFalconForcebyOlaf Hartong·Feb 10, 2023Microsoft Defender for Endpoint Internals 0x04 — TimelineThe MDE timeline has information which is not available in the advanced hunting interface and vice versa. Don’t be blind sighted.A response icon4A response icon4
InFalconForcebyOlaf Hartong·Sep 16, 2022FalconFriday — Detecting LSASS dumping with debug privileges — 0xFF1FCredential dumping from Local Security Authority Subsystem Service (LSASS)
Olaf Hartong·Aug 16, 2022Sysmon 14.0 — FileBlockExecutableThe Sysinternals team has released a new version of Sysmon. This brings the version number to 14.0 and raises the schema to 4.82.
