Series of blog posts that share the breadth and depth of Huntress’ experience to assist others in reducing their attack surface, and inhibiting or even obviating cyber attacks.

Review our latest Fortinet analysis that breaks encryption on firmware images, leading to improved detection, fingerprinting, and exploit development.

In this article we’ll discuss SOC analyst tools, common security definitions, MITRE ATT&CK framework, Cyber Kill Chain, & Zero Trust.

How are you maximizing your searching and reporting abilities? Splunk Data Models can take your searches and their efficiency to the next level.

An introduction to monitoring and logging in linux to look for persistence.

How attackers use newly created and existing accounts for peristence and how to detect them.

How attackers use newly created and existing accounts for peristence and how to detect them.

How attackers create can maintain persistence by inserting scripts and executables in special locations that will run on boot or logon

How attackers can insert backdoors early in the boot process using systemd generators

Speakers: Michaela Adams, Roman Daszczyszak, & Steve Luke

The Center for Threat-Informed Defense presents their “Summiting the Pyramid” research project at Schmoocon, a major cybersecurity conference. Steve Luke, Michaela Adams, and Roman Dasczcyszak explain…

This PR allows to remotely extract hashes from the SAM and SECURITY (LSA Secrets and cached credentials) registry hives without touching disk. There is no need to save these registry hives to disk ...

Microsoft Active Directory is a common target for threat actors after breaching a network. Learn more from Specops Software about the tools attackers use and how to protect your Active Directory.

DarkGate has been observed distributing malware through Microsoft Teams and even via malvertising campaigns.

PingRAT secretly passes C2 traffic through firewalls using ICMP payloads. - umutcamliyurt/PingRAT

Introduction