#01
Building an Incident Response Playbook
A defender's guide to writing IR playbooks that work under pressure: lifecycle, roles and authority, detection triggers, containment trade-offs, and testing.
ler #02
Log Analysis for Incident Response at Scale
How defenders turn high-volume telemetry into a defensible timeline: prioritized collection, normalization, correlation, retention and detection at scale.
ler #03
LOLBins Explained: Detecting Living-Off-the-Land for Blue Teams
A defender's guide to LOLBins: how living-off-the-land evades controls, the telemetry that reveals abuse, and a detection and hardening checklist.
ler #04
Network Forensics with Zeek and PCAP Analysis for Defenders
A defensive guide to network forensics with Zeek and PCAP: how the tools work, the logs that matter, detecting C2 and exfiltration, and a checklist.
ler #05
Memory Forensics with Volatility 3: A Field Guide for Defenders
A practical, defensive field guide to memory forensics with Volatility 3: acquisition, core plugins, detecting injection and rootkits, and a checklist.
ler #06
Supply Chain Security: SBOM, Signing and Provenance for Defenders
Defender's guide to software supply chain security: how SBOMs, signing and provenance work, with detection signals and a hardening checklist.
ler #07
Mobile Device Security and MDM Baselines for Defenders
A defensive guide to mobile security: MDM enrollment models, a hardening baseline, compliance-gated access, MDM and identity detection signals, and a rehearsed lost-device response.
ler #08
Metadata Leakage: What Your Files Quietly Reveal
How hidden document and image metadata leaks reconnaissance to outsiders, how to detect it in published files with tools like exiftool, and how to strip and govern it by default.
ler #09
Secure Remote Work: A Practical Defender's Playbook
A blue-team playbook for securing remote and hybrid work: zero trust, phishing-resistant MFA, endpoint hardening, and the identity and log signals that reveal trouble early.
ler #10
Password Policy and Managers for Teams
A modern, defence-first guide to team password policy and password managers, aligned with current guidance, with detection signals and hardening controls.
ler #11
Building a Security Awareness Program That Works
How to design a security awareness program that measurably changes behaviour, with a reporting culture, detection metrics, and hardening steps.
ler #12
Threat Modeling with STRIDE for Real Systems
A practical, defence-first guide to applying the STRIDE threat modeling framework to real production systems, with detection signals and hardening controls.
ler #13
Network Segmentation and Microsegmentation: A Defensive Strategy
How defenders use network segmentation and microsegmentation to stop lateral movement: zone design, enforcement, detection, and a safe rollout.
ler #14
Database Hardening: PostgreSQL and MySQL in Production
A defender's guide to hardening PostgreSQL and MySQL in production: authentication, network isolation, least privilege, encryption, and detection.
ler #15
Windows Server Security Baseline for 2026: A Defender's Guide
Build and enforce a Windows Server security baseline for 2026: identity hardening, protocol cleanup, credential protection, and the detections that catch drift.
ler #16
MFA and Passkeys: Rolling Out Phishing-Resistant Auth
A blue-team guide to phishing-resistant auth: why shared-secret MFA fails, how passkeys and FIDO2 work, and a safe rollout without weak fallbacks.
ler #17
Ransomware Resilience: Backups, Segmentation and Recovery
A blue-team guide to surviving ransomware: the kill chain, network and identity segmentation, immutable isolated backups, and a recovery plan you rehearse.
ler #18
Object Storage Security: Locking Down S3 and Buckets
Blue-team guide to hardening S3 and cloud buckets: how exposure happens, detection signals to watch, and mitigation from public-access blocks to backups.
ler #19
Cloud IAM Least Privilege on AWS, Azure and GCP: A Defender's Guide
Practical least-privilege for cloud IAM: how over-permissioning enables escalation, how to spot risky access, and a checklist for AWS, Azure and GCP.
ler #20
DNS Security for Defenders: DNSSEC, DoH and Registrar Hardening
How to defend the DNS layer: what DNSSEC and encrypted DNS actually protect, how to detect hijacking and cache poisoning, and a registrar hardening checklist.
ler #21
Email Authentication Explained: SPF, DKIM and DMARC for Defenders
A defender's guide to SPF, DKIM and DMARC: how each control works, how to detect spoofing in your reports, and a hardening checklist to lock down your domain.
ler #22
Secrets Management with a Vault: Patterns and Pitfalls
A defender's guide to secrets management: what a vault provides, dynamic secrets, audit telemetry, rotation, and the pitfalls that quietly undo it.
ler #23
TLS, PKI and Certificate Management Done Right
How defenders can run TLS and PKI without outages or weak links: the chain of trust, lifecycle automation, detection signals, and a hardening checklist.
ler #24
Zero Trust Network Architecture in Practice
A defender's guide to Zero Trust: identity-first access, microsegmentation, the telemetry that proves it works, and a hardening checklist you can act on.
ler #25
Active Directory Tiering and Privileged Access Design
How Active Directory tiering and privileged access design contain lateral movement: the tier model, clean sources, PAWs, just-in-time access, detection.
ler #26
Container and Docker Image Security End to End
Secure the whole container lifecycle: base images, builds, signing, scanning, registry and runtime controls, with detection signals and a defender checklist.
ler #27
Kubernetes Security Hardening: A Practical Baseline
A practical Kubernetes hardening baseline for defenders: control plane, RBAC, workload and network controls, plus detection signals and a checklist.
ler #28
Credential Dumping: Detection and Defense for Blue Teams
A defensive guide to credential dumping: understand how the technique works at a high level, then detect, mitigate, and harden against it with logs, EDR telemetry, and concrete controls.
ler #29
Pass-the-Hash and Pass-the-Ticket: Mechanics and Detection for Blue Teams
How Pass-the-Hash and Pass-the-Ticket work, the Windows telemetry that reveals them, and the hardening that stops these credential-theft techniques.
ler #30
Kerberoasting and AD Credential Attacks: Detection and Defense
A blue-team guide to Kerberoasting: how the Kerberos abuse works, Event ID 4769 detection, gMSA and AES hardening, and a defender checklist.
ler #31
Windows Token Impersonation: A Defender's Guide to Detection and Hardening
Windows access token impersonation (ATT&CK T1134) for defenders: how it works, detection with Event IDs and EDR telemetry, plus hardening steps.
ler #32
AppSec Shift-Left: SAST, SCA and Secrets Scanning Without Slowing the Team
How Basilisk OffSec rolls out AppSec gradually, measuring developer friction and avoiding the permanently red pipeline nobody bothers to read.
ler #33
EDR Evasion for Research: Direct Syscalls Explained Without the Hype
How direct syscalls actually work in controlled defensive study, why they remain detectable, and what blue teams should look for before buying the next black box.
ler #34
Exploring File Upload Vulnerabilities Without Breaking the Law
How to bypass upload validations in your own lab, map the bug classes, and harden webservers against RCE via malicious file.
ler #35
Digital Compartmentalization: Separate Identities Without Leaking Metadata
How to keep personas, browsers and devices actually isolated by closing the metadata leaks that destroy any separation within minutes.
ler #36
Comms OPSEC: Signal, SimpleX and Session Technically Compared
Technical breakdown of protocols, metadata and threat models for Signal, SimpleX and Session, with practical selection criteria per scenario.
ler #37
Authorized Red Team Phishing: Templates, GoPhish and Ethical Guardrails
How written-scope red team engagements use GoPhish, build believable templates, and why firing a campaign without authorization ends careers.
ler #38
Pivoting with Chisel and Ligolo-ng: Segmented Networks in a Pentest Lab
How to pivot across VLANs using Chisel and Ligolo-ng in a controlled lab, and which artifacts the blue team can capture to detect the reverse tunnel.
ler #39
Container Forensics: Investigating Kubernetes Compromises Like a Pro
How the Basilisk team collects evidence from pods, runtime, and control plane after a suspected incident in production Kubernetes clusters.
ler #40
Windows Persistence: 10 Documented Techniques and Their Countermeasures
Defensive catalog of 10 Windows persistence mechanisms with ready-to-run KQL hunting queries and hardening measures any SOC can deploy this week.
ler #41
Lateral Movement in the Lab: SMB, WMI and WinRM with a Detection Focus
We reproduce three classic lateral movement techniques in GOAD and show how to turn each one into a Sigma rule the blue team can actually use.
ler #42
Red Team 101: How Pentests Differ from Real Adversarial Operations
A pentest is not a red team. Learn scope, ROE, objectives, and why ethical discipline defines whether an adversarial engagement actually delivers value.
ler #43
STRIDE Threat Modeling in Sprints: A Full Microservice Walkthrough
How to apply STRIDE to a real payments microservice inside a two-week sprint, with a clean DFD, prioritized threats, and actionable mitigations.
ler #44
Personal Crypto: Hardware Wallets, Passphrase and Coercion-Resistant Backup
How to build self-sovereign crypto custody using a hardware wallet, BIP39 passphrase and metal backup designed against phishing and physical attacks.
ler #45
Windows 11 Hardening for High-Risk Offensive Security Workstations
Battle-tested Windows 11 hardening recipe with ASR, Credential Guard, AppLocker and WDAC deployed across Basilisk offensive analyst laptops.
ler #46
Memory Forensics with Volatility 3: Analyzing Dumps in a Reproducible Lab
Technical memory analysis workflow with Volatility 3, sandbox-reproduced dumps and cross-validation against Rekall and MemProcFS.
ler #47
Modern XSS: DOM, Stored and Reflected With Real Examples in a Test Lab
Three XSS flavors dissected in a sandbox with payloads, exploitation flow, and mitigations via strict CSP, Trusted Types and DOMPurify sanitization.
ler #48
Purple Team in Practice: Building a Red vs Blue Feedback Loop
How to integrate adversarial emulation with the SOC, close detection gaps in short sprints, and turn exercises into versioned Sigma rules.
ler #49
DFIR on Linux: Live Triage with UAC and Velociraptor
How the Basilisk team runs live triage on compromised Linux hosts using UAC and Velociraptor without destroying volatile evidence.
ler #50
Supply Chain Security: Sigstore Signing and Real SBOMs in CI/CD
How Basilisk ships cosign, SLSA, and CycloneDX across real pipelines to blunt SolarWinds-style attacks, XZ Utils backdoors, and dependency confusion.
ler #51
Linux Server Hardening: Applying CIS Benchmark Without Breaking Production
How to apply the CIS Benchmark on production Debian and Ubuntu hosts by validating each control, measuring impact, and keeping SLA intact without an all-night rollback.
ler #52
Tails, Whonix or Qubes OS: Which to Pick for Each OPSEC Scenario
Technical comparison of Tails, Whonix and Qubes OS with objective criteria around threat model, compartmentalization and operational cost to pick the right OS.
ler #53
REST and GraphQL API Pentest: Technical Checklist for Legal Bug Bounty
Hands-on methodology for testing REST and GraphQL APIs in authorized programs, focused on IDOR, authentication bypass and malicious introspection.
ler #54
AMSI and ETW Bypass for Defensive Research: What Blue Teams Should Know
Honest technical breakdown of how public AMSI and ETW bypasses work, and how defenders can harden Windows telemetry without looking foolish.
ler #55
macOS Incident Forensics: UnifiedLogs, FSEvents and AULR in Practice
How Basilisk collects evidence on macOS Sonoma and Sequoia using UnifiedLogs, FSEvents and AULR without trampling the incident scene.
ler #56
Ethical OSINT: Investigating Your Own Digital Footprint with Maltego and Spiderfoot
Before a stalker, hostile recruiter, or data broker finds you, do the work yourself. Maltego and Spiderfoot turn public fragments into a personal attack map.
ler #57
OPSEC for Security Researchers: Building a Personal Threat Model
Before you install Tails, Qubes or Signal, draw your individual threat model. Skip it and you are just stacking tools and burning effort in the wrong place.
ler #58
SELinux Without Fear: Custom Policies for Critical Services
From audit2allow forensics to versioned policy modules running in production, without falling into permanent permissive mode.
ler #59
Hunting Living-off-the-Land Binaries on Windows with KQL
Production-ready KQL queries for Microsoft Defender and Sentinel to hunt LOLBin abuse from rundll32, mshta, and certutil in real environments.
ler #60
Advanced Nmap: NSE Scripts for Internal Recon in a Simulated Corporate Lab
How to get real value out of NSE for authorized enumeration on simulated internal networks, with script examples, output parsing, and pentest pipeline integration.
ler #61
Simulated Initial Access: Macros, LNK and ISO in an Isolated Windows 11 Lab
We replayed three classic initial access vectors inside a sealed Windows 11 lab to see what the EDR actually logs and where detection quietly falls apart.
ler #62
Web Pentesting From Scratch: Building a Safe Lab with DVWA, Juice Shop and Burp Suite
Hands-on guide to building an isolated web pentest lab with DVWA, Juice Shop and Burp Suite configured under clear legal and safety rules.
ler #63
SSH Hardening 2026: Algorithms, Certificates and Bastion Hosts
Modern SSH configuration with an internal CA, resistant algorithms and auditable bastion hosts to shrink the attack surface in corporate environments.
ler #64
Metadata Hygiene: Stripping EXIF, PDF and Office Before You Publish
How to remove metadata that leaks identity, GPS and authorship from images, PDFs and Office documents before publishing online.
ler #65
Android Mobile App Pentest: Frida, MobSF, and a Genymotion Lab
End-to-end setup for dynamic analysis of your own APKs using Frida, MobSF, and Genymotion, with hands-on hooks and a technical checklist.
ler #66
Passwords and MFA: Moving to Passkeys Without Breaking Your Recovery
Passkeys kill phishing and MFA fatigue, but a sloppy migration locks legitimate users out. Plan fallback, devices and roaming with no holes.
ler #67
Linux Application Sandboxing with Bubblewrap, Firejail and Flatpak
How the Basilisk team isolates browsers, PDF readers and risky tools on Linux desktops using audited, reproducible sandbox profiles.
ler #68
Adversary Emulation with Caldera and MITRE ATT&CK in a Corporate Lab
How Basilisk uses Caldera, Atomic Red Team and MITRE ATT&CK to simulate real TTPs in a closed lab and measure SOC maturity without breaking production.
ler #69
Personal Security for High-Visibility Targets: Journalists, Activists, and Executives
Defensive playbook for people with public profiles: from threat modeling to digital hygiene, with tools battle-tested in the field.
ler #70
SSRF Demystified: Exploiting Cloud Metadata in a Local AWS Lab
Ethical SSRF reproduction against IMDS using LocalStack, with real payloads, simulated credential theft and definitive mitigation via IMDSv2.
ler #71
macOS Hardening: Lockdown Mode, MDM and Attack Surface Reduction
Defensive configurations on Apple Silicon for journalists, activists and researchers facing well-funded state or commercial adversaries.
ler #72
Building C2 Infra with Sliver in an Isolated Lab for Defensive Research
Spinning up a Sliver C2 air-gapped is not hacker theater: it is how Blue Teams learn to detect what they will face tomorrow. Hands-on technical walkthrough.
ler #73
Active Directory Pentest: Step-by-Step Kerberoasting in a GOAD Lab
Ethical Kerberoasting walkthrough on Game of Active Directory: TGS capture, offline crack with hashcat, and detection via Event ID 4769.
ler #74
Malware Analysis in an Isolated Lab: Safe Setup with FlareVM and REMnux
How to build an air-gapped lab with FlareVM and REMnux for reverse engineering real samples without contaminating your network or burning IOCs.
ler #75
SQL Injection in Practice: Exploiting, Detecting and Mitigating in a Controlled Lab
Hands-on SQLi demo with sqlmap in your own lab, focused on defensive detection and parameterized fixes that actually hold up against production traffic.
ler #76
Threat Hunting with Sigma and Elastic: From Indicator to Detection Rule
How to turn attack hypotheses into Sigma rules tested in Elastic, with a reproducible lab validation pipeline.
ler #77
Anti-Doxxing Personal Security: Removing Data from Brazilian Data Brokers
Hands-on technical procedure to cut your exposure on Brazilian data brokers, social media and public records before a doxxer does it for you.
ler #78
Real Anonymity with Tor: What Works and What is Myth in 2026
Tor is not an invisibility cloak. Where the network truly protects, where traffic correlation breaks anonymity, and how to use it sensibly in 2026.
ler #79
Disk Crypto and Backups: VeraCrypt, LUKS and a Resilient 3-2-1 Strategy
How to encrypt disks with LUKS2 and VeraCrypt and build verified 3-2-1 backups, with a recovery plan tested in the lab.
ler #80
Timeline Forensics on Windows: Plaso, Log2Timeline and KAPE in Practice
Building super-timelines of a compromised Windows 11 test VM with KAPE for triage collection and Plaso parsing 200+ artifacts.
ler #81
Dependency Confusion and Typosquatting: Practical Defense for Dev Teams
How registry policies, lockfiles and scoping block malicious packages before they hit the build. Hands-on technical guide from the Basilisk team.
ler