When a cyber incident occurs, one of the first challenges is understanding what happened, which systems were involved, and what traces were left behind. In this context, Velociraptor can help: It’s an open-source DFIR tool that can collect and examine endpoint data in a centralized, targeted, and repeatable way. After completing a course focused on…
Read MoreA field briefing on space threat intelligence, for security teams that run zero satellites but depend on dozens of them I don’t work in the space industry. I don’t design satellites, operate ground stations, or even analyze orbital telemetry in real time. Worth saying upfront, because it’s the right starting point for this kind of…
Read More
Turning Relevant Campaigns into Actionable Security Content To prioritize detection rule deployment based on threats that could realistically affect our organization or customer environments, we’ve developed an intelligence-driven detection model. Rather than prioritizing rules solely by mapping MITRE ATT&CK techniques and addressing coverage gaps indiscriminately, the model uses threat intelligence to identify which campaigns, behaviors,…
Read MoreData exfiltration is rarely as obvious as a large file being copied to an attacker-controlled server. In many environments, sensitive information leaves through channels that look legitimate: a cloud storage service, a familiar application, an unusual destination country, or a removable device. This is where Elastic’s Data Exfiltration Detection (DED) package can help. Instead of…
Read MoreThe first half of 2026 marked a structural shift in how cyber criminals and state-sponsored groups achieve initial access. Rather than targeting corporate perimeters directly, adversaries have increasingly exploited the “web of trust”, generally known as supply chain attacks. This means compromising open-source code registries, developer utilities, and third-party SaaS integrations. According to threat intelligence…
Read MoreEvery red team engagement that involves a phishing scenario runs into the same wall sooner or later: You need a mail server you fully control, one that behaves like a real corporate mail system, sends and receives reliably, and does not torch your reputation the moment you use it. The answer is to compose your…
Read MoreAs threat analysts, we spend our days dissecting malicious code, tracking infrastructure, and reverse-engineering adversary tactics. But what happens when the threat actor refuses to even let us see the payload? In recent years, the Cyber Threat Intelligence (CTI) landscape has witnessed a massive shift. Adversaries have realized that the best way to protect their…
Read MoreCloud Security Posture Management describes a category of tools that inspect cloud environments for configuration problems like public storage, overly broad IAM permissions, disabled logging, and missing encryption. The category includes open-source projects like Prowler and ScoutSuite, as well as commercial platforms. Despite different pricing models and interfaces, they solve the same underlying problem in…
Read MoreThe View from the SOC From inside the SOC, authentication traffic never really stops. Most of it is ordinary business: people signing in, services renewing sessions, or developers moving between tools. Mixed into that stream is something far less ordinary: repeated, automated attempts to become someone else. That’s why identity work sits so close to…
Read MoreThe first half of 2026 has witnessed the transition of artificial intelligence from an experimental playground into a cyber warfare domain. In fact, threat actors have shifted from basic prompting toward highly automated, multi-stage operations. This shift is characterized by a bifurcation of threats. On one side, attacks exploiting inherent AI vulnerabilities and architectural boundaries,…
Read More1. Introduction The abuse of vulnerable drivers has become an increasingly common technique adopted by attackers to bypass modern security controls. This attack pattern, commonly referred to as Bring Your Own Vulnerable Driver (BYOVD), consists of loading legitimately signed but vulnerable drivers into the operating system in order to gain kernel-level privileges, disable security products,…
Read MoreIn cybersecurity, the gap between what we think we can detect and what we actually detect is often wider than we expect. Tools are configured, rules are written, playbooks are drafted, and yet, when a real attack unfolds, the telemetry is incomplete, the alerts are noisy, and the response is slower than it should be….
Read MoreAs a Cyber Threat Intelligence (CTI) Analyst, my daily work often involves analyzing suspicious domains that look like our clients’ brands. One of our goals is to prevent phishing campaigns and brand abuse. We usually hunt for external threats like typosquatting. However, sometimes the most dangerous threat comes directly from the legitimate infrastructure within the…
Read MoreSOAR for Controlled Response SOAR is often described in broad terms: orchestration, automation, response, integration. That’s true, but it can also feel vague. A simpler way to explain it is this: SOAR helps a SOC turn a decision into action without repeating the same manual steps every time. This matters most when the action is…
Read MoreWhy a Purple Team Program Makes Cybersecurity More Effective In today’s cybersecurity landscape, having defensive tools in place is no longer enough. Firewalls, SIEM platforms, detection rules, playbooks, and threat intelligence feeds are all essential components, but the real question is this: how well do they actually perform under realistic attack conditions? This is where…
Read More