The Digital Parasite: How Attacker Tradecraft Evolved in 2026
Picus Labs found evasion, persistence and command-and-control techniques in eight of its 2026 top ten malware behaviors. What defenders can take from the data.
Lateral Movement
6 articles
AD Attack Chains: From Initial Access to Domain Admin
A complete purple team walkthrough of Active Directory attack chains — from initial foothold through Kerberoasting, DCSync, and Golden Tickets to full domain compromise, with detection rules for every technique.
Linux Lateral Movement: Attack Techniques and How to Detect Them
A complete guide to Linux lateral movement — SSH pivoting, ssh-agent hijacking, credential harvesting, port forwarding, and NFS abuse. Includes auditd rules, Sigma, Wazuh, and Sentinel KQL detections.
Pass-the-Hash & Pass-the-Ticket: How Attackers Move Laterally — and How to Catch Them
A practitioner's guide to PtH and PtT attacks: how they work, what tools attackers use, what evidence they leave behind, and how to build detections with Sigma and Wazuh.
Starkiller: Inside Empire's C2 GUI — Red Team Playbook and Blue Team Detection
A technical deep dive into Starkiller and PowerShell Empire — how red teams deploy and operate it, and exactly how defenders can detect and disrupt it.
Zero Trust vs. Real Attacks: Which Threats Does It Actually Stop?
Discover which real-world cyberattacks Zero Trust prevents—and which ones it doesn't. Analyzed through 2025-2026 breach data including ransomware campaigns, insider threats, supply chain compromises, and social engineering attacks.