Threat Hunting

LOLBins in 2026: How Attackers Use Windows Against Itself

79% of attacks in 2024 used no malware at all. Attackers abuse Windows' own built-in tools — certutil, mshta, rundll32 — to execute code and evade detection. Here's the full attack playbook and how to detect it.

Windows Event Logs for Security Analysts: Read, Hunt, Automate

A practical guide to Windows Event Log analysis for blue teams — key Event IDs, PowerShell automation, cross-version differences, and structured exports for SIEM tools.

Salt Typhoon: How China Hacked the World's Largest Telecoms — And How It Could Have Been Detected

Salt Typhoon is the worst telecom breach in history. The Chinese APT stayed hidden for years inside AT&T, Verizon and T-Mobile. Here's the full attack chain, the tools they used, and the detection opportunities blue teams missed.

Starkiller: Inside Empire's C2 GUI — Red Team Playbook and Blue Team Detection

A technical deep dive into Starkiller and PowerShell Empire — how red teams deploy and operate it, and exactly how defenders can detect and disrupt it.

Threat Hunting with Wazuh: Building Effective Detection Rules

A practical guide to writing custom Wazuh rules for threat hunting, covering rule anatomy, decoder chaining, and real-world detection scenarios.

MDR in Plain English: What It Solves That Tools Alone Can't

Understand why Managed Detection and Response (MDR) delivers what security tools can't—24/7 expert-led threat hunting, investigation, and active remediation. Learn how MDR solves the talent shortage and reduces costs by 15x compared to in-house SOCs.