Author
102 publications
Pivoting and Tunneling: A Blue-Team Guide to Detection and Hardening
A defensive guide to network pivoting and tunneling: how lateral movement works, the logs and Event IDs that reveal it, and the segmentation and hardening that stop it.
By Lucas Andrade
Read →
Payload Obfuscation: Concepts and Detection Signals for Defenders
Understand how payload obfuscation works at a high level and, more importantly, how blue teams detect and mitigate it with logs, EDR telemetry, and hardening.
By Lucas Andrade
Read →
BloodHound and AD Attack Path Mapping: A Blue Team Defense Guide
A defensive, understand-to-defend guide to BloodHound and Active Directory attack path mapping: detection via Event IDs and EDR, plus tiered-admin hardening.
By Lucas Andrade
Read →
Password Spraying: Detection and Defensive Countermeasures
A blue-team guide to password spraying: how the threat behaves, the telemetry that reveals it, and the identity hardening that stops it before an account is taken.
By Lucas Andrade
Read →
DLL Sideloading and Hijacking: How It Works and How to Catch It
A defender's guide to DLL sideloading and search-order hijacking: how the technique abuses trust, the telemetry that exposes it, and concrete hardening steps.
By Lucas Andrade
Read →
Hardening CI/CD Pipelines Against Compromise
A defender's guide to securing CI/CD: the attack surface, how compromise happens, detection signals, and a hardening checklist for runners and secrets.
By Lucas Andrade
Read →
Cloud Security Posture Management (CSPM) in Practice
A defender's guide to CSPM: how it works, the misconfigurations it catches, detection signals to watch, and a hardening workflow for the cloud.
By Lucas Andrade
Read →
SIEM Detection Engineering with Sigma Rules: A Practical Blue-Team Guide
Build reliable, portable detections with Sigma and your SIEM: how the format works, how to tune for signal over noise, and detection-as-code.
By Lucas Andrade
Read →
WiFi Security Assessment: Methodology and Defenses for Blue Teams
A defensive guide to WiFi assessment: how wireless attacks work, how to detect rogue APs and deauth, and how to harden WPA3, 802.1X and segmentation.
By Lucas Andrade
Read →
PHP vulnerability Brazilian websites need to know
PHP vulnerability Brazilian websites face after 21 October 2026 may allow remote command execution. See risk and what to ask your host in writing.
By Lucas Andrade
Read →
LiteLLM supply chain attack and what to do now
LiteLLM supply chain attack on October 21, 2026 put malicious 1.107.0 on PyPI and Docker. See the UTC window, IoCs, and the pin to 1.106.2
By Lucas Andrade
Read →
php2shell: what it is and how to fix PHP now
php2shell covers the critical PHP flaws disclosed on October 21, 2026. See affected versions, how to check exposure, and the right fix order.
By Lucas Andrade
Read →
Node.js Brotli vulnerability: Dev and Ops patch guide
Node.js Brotli vulnerability leads the October 21, 2026 security release, with fixed versions, patch order, and interim mitigations.
By Lucas Andrade
Read →
OSINT and Recon for Defenders: Map Your Own Attack Surface
How attackers profile you with OSINT, how to detect reconnaissance, and how to shrink your exposed attack surface with practical hardening.
By Lucas Andrade
Read →
Building a Vulnerability Management Program That Reduces Risk
How defenders build a vulnerability management program: asset inventory, continuous discovery, risk-based prioritization, remediation and metrics.
By Lucas Andrade
Read →
API Security Testing Methodology with the OWASP API Top 10
A defensive API security testing guide built on the OWASP API Top 10: BOLA and BFLA, authentication, data exposure, inventory, detection and hardening.
By Lucas Andrade
Read →
Web Application Security Testing with the OWASP Methodology
A defensive guide to web application security testing with OWASP: WSTG phases, Top 10 coverage, detection telemetry, mitigation and a hardening checklist.
By Lucas Andrade
Read →
Detecting Persistence: A Blue-Team Hunting Guide
Defensive hunting guide to persistence: where adversaries hide to survive reboots, the telemetry and Event IDs that reveal them.
By Lucas Andrade
Read →
Chain of Custody and Evidence Handling for DFIR
Practical DFIR guide to chain of custody: order of volatility, forensic imaging and hashing, custody logs, and secure storage.
By Lucas Andrade
Read →
Cloud Incident Response on AWS: Where to Look First
Blue-team guide to AWS incident response: the log sources that matter, detection signals, and evidence-safe containment.
By Lucas Andrade
Read →
Phishing Email Header and Artifact Analysis
A defensive guide to reading phishing headers and artifacts: Received chain, SPF/DKIM/DMARC, look-alike deception, safe link and attachment triage, and hunting.
By Lucas Andrade
Read →
Building an Incident Response Playbook
A defender's guide to writing IR playbooks that work under pressure: lifecycle, roles and authority, detection triggers, containment trade-offs, and testing.
By Lucas Andrade
Read →
Log Analysis for Incident Response at Scale
How defenders turn high-volume telemetry into a defensible timeline: prioritized collection, normalization, correlation, retention and detection at scale.
By Lucas Andrade
Read →
LOLBins Explained: Detecting Living-Off-the-Land for Blue Teams
A defender's guide to LOLBins: how living-off-the-land evades controls, the telemetry that reveals abuse, and a detection and hardening checklist.
By Lucas Andrade
Read →
Network Forensics with Zeek and PCAP Analysis for Defenders
A defensive guide to network forensics with Zeek and PCAP: how the tools work, the logs that matter, detecting C2 and exfiltration, and a checklist.
By Lucas Andrade
Read →
Memory Forensics with Volatility 3: A Field Guide for Defenders
A practical, defensive field guide to memory forensics with Volatility 3: acquisition, core plugins, detecting injection and rootkits, and a checklist.
By Lucas Andrade
Read →
Supply Chain Security: SBOM, Signing and Provenance for Defenders
Defender's guide to software supply chain security: how SBOMs, signing and provenance work, with detection signals and a hardening checklist.
By Lucas Andrade
Read →
Mobile Device Security and MDM Baselines for Defenders
A defensive guide to mobile security: MDM enrollment models, a hardening baseline, compliance-gated access, MDM and identity detection signals, and a rehearsed lost-device response.
By Lucas Andrade
Read →
Metadata Leakage: What Your Files Quietly Reveal
How hidden document and image metadata leaks reconnaissance to outsiders, how to detect it in published files with tools like exiftool, and how to strip and govern it by default.
By Lucas Andrade
Read →
Secure Remote Work: A Practical Defender's Playbook
A blue-team playbook for securing remote and hybrid work: zero trust, phishing-resistant MFA, endpoint hardening, and the identity and log signals that reveal trouble early.
By Lucas Andrade
Read →
Password Policy and Managers for Teams
A modern, defence-first guide to team password policy and password managers, aligned with current guidance, with detection signals and hardening controls.
By Lucas Andrade
Read →
Building a Security Awareness Program That Works
How to design a security awareness program that measurably changes behaviour, with a reporting culture, detection metrics, and hardening steps.
By Lucas Andrade
Read →
Threat Modeling with STRIDE for Real Systems
A practical, defence-first guide to applying the STRIDE threat modeling framework to real production systems, with detection signals and hardening controls.
By Lucas Andrade
Read →
Network Segmentation and Microsegmentation: A Defensive Strategy
How defenders use network segmentation and microsegmentation to stop lateral movement: zone design, enforcement, detection, and a safe rollout.
By Lucas Andrade
Read →
Database Hardening: PostgreSQL and MySQL in Production
A defender's guide to hardening PostgreSQL and MySQL in production: authentication, network isolation, least privilege, encryption, and detection.
By Lucas Andrade
Read →
Windows Server Security Baseline for 2026: A Defender's Guide
Build and enforce a Windows Server security baseline for 2026: identity hardening, protocol cleanup, credential protection, and the detections that catch drift.
By Lucas Andrade
Read →
MFA and Passkeys: Rolling Out Phishing-Resistant Auth
A blue-team guide to phishing-resistant auth: why shared-secret MFA fails, how passkeys and FIDO2 work, and a safe rollout without weak fallbacks.
By Lucas Andrade
Read →
Ransomware Resilience: Backups, Segmentation and Recovery
A blue-team guide to surviving ransomware: the kill chain, network and identity segmentation, immutable isolated backups, and a recovery plan you rehearse.
By Lucas Andrade
Read →
Object Storage Security: Locking Down S3 and Buckets
Blue-team guide to hardening S3 and cloud buckets: how exposure happens, detection signals to watch, and mitigation from public-access blocks to backups.
By Lucas Andrade
Read →
Cloud IAM Least Privilege on AWS, Azure and GCP: A Defender's Guide
Practical least-privilege for cloud IAM: how over-permissioning enables escalation, how to spot risky access, and a checklist for AWS, Azure and GCP.
By Lucas Andrade
Read →
DNS Security for Defenders: DNSSEC, DoH and Registrar Hardening
How to defend the DNS layer: what DNSSEC and encrypted DNS actually protect, how to detect hijacking and cache poisoning, and a registrar hardening checklist.
By Lucas Andrade
Read →
Email Authentication Explained: SPF, DKIM and DMARC for Defenders
A defender's guide to SPF, DKIM and DMARC: how each control works, how to detect spoofing in your reports, and a hardening checklist to lock down your domain.
By Lucas Andrade
Read →
Secrets Management with a Vault: Patterns and Pitfalls
A defender's guide to secrets management: what a vault provides, dynamic secrets, audit telemetry, rotation, and the pitfalls that quietly undo it.
By Lucas Andrade
Read →
TLS, PKI and Certificate Management Done Right
How defenders can run TLS and PKI without outages or weak links: the chain of trust, lifecycle automation, detection signals, and a hardening checklist.
By Lucas Andrade
Read →
Zero Trust Network Architecture in Practice
A defender's guide to Zero Trust: identity-first access, microsegmentation, the telemetry that proves it works, and a hardening checklist you can act on.
By Lucas Andrade
Read →
Active Directory Tiering and Privileged Access Design
How Active Directory tiering and privileged access design contain lateral movement: the tier model, clean sources, PAWs, just-in-time access, detection.
By Lucas Andrade
Read →
Container and Docker Image Security End to End
Secure the whole container lifecycle: base images, builds, signing, scanning, registry and runtime controls, with detection signals and a defender checklist.
By Lucas Andrade
Read →
Kubernetes Security Hardening: A Practical Baseline
A practical Kubernetes hardening baseline for defenders: control plane, RBAC, workload and network controls, plus detection signals and a checklist.
By Lucas Andrade
Read →
Credential Dumping: Detection and Defense for Blue Teams
A defensive guide to credential dumping: understand how the technique works at a high level, then detect, mitigate, and harden against it with logs, EDR telemetry, and concrete controls.
By Lucas Andrade
Read →
Pass-the-Hash and Pass-the-Ticket: Mechanics and Detection for Blue Teams
How Pass-the-Hash and Pass-the-Ticket work, the Windows telemetry that reveals them, and the hardening that stops these credential-theft techniques.
By Lucas Andrade
Read →
Kerberoasting and AD Credential Attacks: Detection and Defense
A blue-team guide to Kerberoasting: how the Kerberos abuse works, Event ID 4769 detection, gMSA and AES hardening, and a defender checklist.
By Lucas Andrade
Read →
Windows Token Impersonation: A Defender's Guide to Detection and Hardening
Windows access token impersonation (ATT&CK T1134) for defenders: how it works, detection with Event IDs and EDR telemetry, plus hardening steps.
By Lucas Andrade
Read →
AppSec Shift-Left: SAST, SCA and Secrets Scanning Without Slowing the Team
How Basilisk OffSec rolls out AppSec gradually, measuring developer friction and avoiding the permanently red pipeline nobody bothers to read.
By Lucas Andrade
Read →
EDR Evasion for Research: Direct Syscalls Explained Without the Hype
How direct syscalls actually work in controlled defensive study, why they remain detectable, and what blue teams should look for before buying the next black box.
By Lucas Andrade
Read →
Exploring File Upload Vulnerabilities Without Breaking the Law
How to bypass upload validations in your own lab, map the bug classes, and harden webservers against RCE via malicious file.
By Lucas Andrade
Read →
Digital Compartmentalization: Separate Identities Without Leaking Metadata
How to keep personas, browsers and devices actually isolated by closing the metadata leaks that destroy any separation within minutes.
By Lucas Andrade
Read →
Comms OPSEC: Signal, SimpleX and Session Technically Compared
Technical breakdown of protocols, metadata and threat models for Signal, SimpleX and Session, with practical selection criteria per scenario.
By Lucas Andrade
Read →
Authorized Red Team Phishing: Templates, GoPhish and Ethical Guardrails
How written-scope red team engagements use GoPhish, build believable templates, and why firing a campaign without authorization ends careers.
By Lucas Andrade
Read →
Pivoting with Chisel and Ligolo-ng: Segmented Networks in a Pentest Lab
How to pivot across VLANs using Chisel and Ligolo-ng in a controlled lab, and which artifacts the blue team can capture to detect the reverse tunnel.
By Lucas Andrade
Read →
Container Forensics: Investigating Kubernetes Compromises Like a Pro
How the Basilisk team collects evidence from pods, runtime, and control plane after a suspected incident in production Kubernetes clusters.
By Lucas Andrade
Read →
Windows Persistence: 10 Documented Techniques and Their Countermeasures
Defensive catalog of 10 Windows persistence mechanisms with ready-to-run KQL hunting queries and hardening measures any SOC can deploy this week.
By Lucas Andrade
Read →
Lateral Movement in the Lab: SMB, WMI and WinRM with a Detection Focus
We reproduce three classic lateral movement techniques in GOAD and show how to turn each one into a Sigma rule the blue team can actually use.
By Lucas Andrade
Read →
Red Team 101: How Pentests Differ from Real Adversarial Operations
A pentest is not a red team. Learn scope, ROE, objectives, and why ethical discipline defines whether an adversarial engagement actually delivers value.
By Lucas Andrade
Read →
STRIDE Threat Modeling in Sprints: A Full Microservice Walkthrough
How to apply STRIDE to a real payments microservice inside a two-week sprint, with a clean DFD, prioritized threats, and actionable mitigations.
By Lucas Andrade
Read →
Personal Crypto: Hardware Wallets, Passphrase and Coercion-Resistant Backup
How to build self-sovereign crypto custody using a hardware wallet, BIP39 passphrase and metal backup designed against phishing and physical attacks.
By Lucas Andrade
Read →
Windows 11 Hardening for High-Risk Offensive Security Workstations
Battle-tested Windows 11 hardening recipe with ASR, Credential Guard, AppLocker and WDAC deployed across Basilisk offensive analyst laptops.
By Lucas Andrade
Read →
Memory Forensics with Volatility 3: Analyzing Dumps in a Reproducible Lab
Technical memory analysis workflow with Volatility 3, sandbox-reproduced dumps and cross-validation against Rekall and MemProcFS.
By Lucas Andrade
Read →
Modern XSS: DOM, Stored and Reflected With Real Examples in a Test Lab
Three XSS flavors dissected in a sandbox with payloads, exploitation flow, and mitigations via strict CSP, Trusted Types and DOMPurify sanitization.
By Lucas Andrade
Read →
Purple Team in Practice: Building a Red vs Blue Feedback Loop
How to integrate adversarial emulation with the SOC, close detection gaps in short sprints, and turn exercises into versioned Sigma rules.
By Lucas Andrade
Read →
DFIR on Linux: Live Triage with UAC and Velociraptor
How the Basilisk team runs live triage on compromised Linux hosts using UAC and Velociraptor without destroying volatile evidence.
By Lucas Andrade
Read →
Supply Chain Security: Sigstore Signing and Real SBOMs in CI/CD
How Basilisk ships cosign, SLSA, and CycloneDX across real pipelines to blunt SolarWinds-style attacks, XZ Utils backdoors, and dependency confusion.
By Lucas Andrade
Read →
Linux Server Hardening: Applying CIS Benchmark Without Breaking Production
How to apply the CIS Benchmark on production Debian and Ubuntu hosts by validating each control, measuring impact, and keeping SLA intact without an all-night rollback.
By Lucas Andrade
Read →
Tails, Whonix or Qubes OS: Which to Pick for Each OPSEC Scenario
Technical comparison of Tails, Whonix and Qubes OS with objective criteria around threat model, compartmentalization and operational cost to pick the right OS.
By Lucas Andrade
Read →
REST and GraphQL API Pentest: Technical Checklist for Legal Bug Bounty
Hands-on methodology for testing REST and GraphQL APIs in authorized programs, focused on IDOR, authentication bypass and malicious introspection.
By Lucas Andrade
Read →
AMSI and ETW Bypass for Defensive Research: What Blue Teams Should Know
Honest technical breakdown of how public AMSI and ETW bypasses work, and how defenders can harden Windows telemetry without looking foolish.
By Lucas Andrade
Read →
macOS Incident Forensics: UnifiedLogs, FSEvents and AULR in Practice
How Basilisk collects evidence on macOS Sonoma and Sequoia using UnifiedLogs, FSEvents and AULR without trampling the incident scene.
By Lucas Andrade
Read →
Ethical OSINT: Investigating Your Own Digital Footprint with Maltego and Spiderfoot
Before a stalker, hostile recruiter, or data broker finds you, do the work yourself. Maltego and Spiderfoot turn public fragments into a personal attack map.
By Lucas Andrade
Read →
OPSEC for Security Researchers: Building a Personal Threat Model
Before you install Tails, Qubes or Signal, draw your individual threat model. Skip it and you are just stacking tools and burning effort in the wrong place.
By Lucas Andrade
Read →
SELinux Without Fear: Custom Policies for Critical Services
From audit2allow forensics to versioned policy modules running in production, without falling into permanent permissive mode.
By Lucas Andrade
Read →
Hunting Living-off-the-Land Binaries on Windows with KQL
Production-ready KQL queries for Microsoft Defender and Sentinel to hunt LOLBin abuse from rundll32, mshta, and certutil in real environments.
By Lucas Andrade
Read →
Advanced Nmap: NSE Scripts for Internal Recon in a Simulated Corporate Lab
How to get real value out of NSE for authorized enumeration on simulated internal networks, with script examples, output parsing, and pentest pipeline integration.
By Lucas Andrade
Read →
Simulated Initial Access: Macros, LNK and ISO in an Isolated Windows 11 Lab
We replayed three classic initial access vectors inside a sealed Windows 11 lab to see what the EDR actually logs and where detection quietly falls apart.
By Lucas Andrade
Read →
Web Pentesting From Scratch: Building a Safe Lab with DVWA, Juice Shop and Burp Suite
Hands-on guide to building an isolated web pentest lab with DVWA, Juice Shop and Burp Suite configured under clear legal and safety rules.
By Lucas Andrade
Read →
SSH Hardening 2026: Algorithms, Certificates and Bastion Hosts
Modern SSH configuration with an internal CA, resistant algorithms and auditable bastion hosts to shrink the attack surface in corporate environments.
By Lucas Andrade
Read →
Metadata Hygiene: Stripping EXIF, PDF and Office Before You Publish
How to remove metadata that leaks identity, GPS and authorship from images, PDFs and Office documents before publishing online.
By Lucas Andrade
Read →
Android Mobile App Pentest: Frida, MobSF, and a Genymotion Lab
End-to-end setup for dynamic analysis of your own APKs using Frida, MobSF, and Genymotion, with hands-on hooks and a technical checklist.
By Lucas Andrade
Read →
Passwords and MFA: Moving to Passkeys Without Breaking Your Recovery
Passkeys kill phishing and MFA fatigue, but a sloppy migration locks legitimate users out. Plan fallback, devices and roaming with no holes.
By Lucas Andrade
Read →
Linux Application Sandboxing with Bubblewrap, Firejail and Flatpak
How the Basilisk team isolates browsers, PDF readers and risky tools on Linux desktops using audited, reproducible sandbox profiles.
By Lucas Andrade
Read →
Adversary Emulation with Caldera and MITRE ATT&CK in a Corporate Lab
How Basilisk uses Caldera, Atomic Red Team and MITRE ATT&CK to simulate real TTPs in a closed lab and measure SOC maturity without breaking production.
By Lucas Andrade
Read →
Personal Security for High-Visibility Targets: Journalists, Activists, and Executives
Defensive playbook for people with public profiles: from threat modeling to digital hygiene, with tools battle-tested in the field.
By Lucas Andrade
Read →
SSRF Demystified: Exploiting Cloud Metadata in a Local AWS Lab
Ethical SSRF reproduction against IMDS using LocalStack, with real payloads, simulated credential theft and definitive mitigation via IMDSv2.
By Lucas Andrade
Read →
macOS Hardening: Lockdown Mode, MDM and Attack Surface Reduction
Defensive configurations on Apple Silicon for journalists, activists and researchers facing well-funded state or commercial adversaries.
By Lucas Andrade
Read →
Building C2 Infra with Sliver in an Isolated Lab for Defensive Research
Spinning up a Sliver C2 air-gapped is not hacker theater: it is how Blue Teams learn to detect what they will face tomorrow. Hands-on technical walkthrough.
By Lucas Andrade
Read →
Active Directory Pentest: Step-by-Step Kerberoasting in a GOAD Lab
Ethical Kerberoasting walkthrough on Game of Active Directory: TGS capture, offline crack with hashcat, and detection via Event ID 4769.
By Lucas Andrade
Read →
Malware Analysis in an Isolated Lab: Safe Setup with FlareVM and REMnux
How to build an air-gapped lab with FlareVM and REMnux for reverse engineering real samples without contaminating your network or burning IOCs.
By Lucas Andrade
Read →
SQL Injection in Practice: Exploiting, Detecting and Mitigating in a Controlled Lab
Hands-on SQLi demo with sqlmap in your own lab, focused on defensive detection and parameterized fixes that actually hold up against production traffic.
By Lucas Andrade
Read →
Threat Hunting with Sigma and Elastic: From Indicator to Detection Rule
How to turn attack hypotheses into Sigma rules tested in Elastic, with a reproducible lab validation pipeline.
By Lucas Andrade
Read →
Anti-Doxxing Personal Security: Removing Data from Brazilian Data Brokers
Hands-on technical procedure to cut your exposure on Brazilian data brokers, social media and public records before a doxxer does it for you.
By Lucas Andrade
Read →
Real Anonymity with Tor: What Works and What is Myth in 2026
Tor is not an invisibility cloak. Where the network truly protects, where traffic correlation breaks anonymity, and how to use it sensibly in 2026.
By Lucas Andrade
Read →
Disk Crypto and Backups: VeraCrypt, LUKS and a Resilient 3-2-1 Strategy
How to encrypt disks with LUKS2 and VeraCrypt and build verified 3-2-1 backups, with a recovery plan tested in the lab.
By Lucas Andrade
Read →
Timeline Forensics on Windows: Plaso, Log2Timeline and KAPE in Practice
Building super-timelines of a compromised Windows 11 test VM with KAPE for triage collection and Plaso parsing 200+ artifacts.
By Lucas Andrade
Read →
Dependency Confusion and Typosquatting: Practical Defense for Dev Teams
How registry policies, lockfiles and scoping block malicious packages before they hit the build. Hands-on technical guide from the Basilisk team.
By Lucas Andrade
Read →