Category
Red Team
20 publications
Pivoting and Tunneling: A Blue-Team Guide to Detection and Hardening
A defensive guide to network pivoting and tunneling: how lateral movement works, the logs and Event IDs that reveal it, and the segmentation and hardening that stop it.
Read →
Payload Obfuscation: Concepts and Detection Signals for Defenders
Understand how payload obfuscation works at a high level and, more importantly, how blue teams detect and mitigate it with logs, EDR telemetry, and hardening.
Read →
BloodHound and AD Attack Path Mapping: A Blue Team Defense Guide
A defensive, understand-to-defend guide to BloodHound and Active Directory attack path mapping: detection via Event IDs and EDR, plus tiered-admin hardening.
Read →
Password Spraying: Detection and Defensive Countermeasures
A blue-team guide to password spraying: how the threat behaves, the telemetry that reveals it, and the identity hardening that stops it before an account is taken.
Read →
DLL Sideloading and Hijacking: How It Works and How to Catch It
A defender's guide to DLL sideloading and search-order hijacking: how the technique abuses trust, the telemetry that exposes it, and concrete hardening steps.
Read →
LOLBins Explained: Detecting Living-Off-the-Land for Blue Teams
A defender's guide to LOLBins: how living-off-the-land evades controls, the telemetry that reveals abuse, and a detection and hardening checklist.
Read →
Credential Dumping: Detection and Defense for Blue Teams
A defensive guide to credential dumping: understand how the technique works at a high level, then detect, mitigate, and harden against it with logs, EDR telemetry, and concrete controls.
Read →
Pass-the-Hash and Pass-the-Ticket: Mechanics and Detection for Blue Teams
How Pass-the-Hash and Pass-the-Ticket work, the Windows telemetry that reveals them, and the hardening that stops these credential-theft techniques.
Read →
Kerberoasting and AD Credential Attacks: Detection and Defense
A blue-team guide to Kerberoasting: how the Kerberos abuse works, Event ID 4769 detection, gMSA and AES hardening, and a defender checklist.
Read →
Windows Token Impersonation: A Defender's Guide to Detection and Hardening
Windows access token impersonation (ATT&CK T1134) for defenders: how it works, detection with Event IDs and EDR telemetry, plus hardening steps.
Read →
EDR Evasion for Research: Direct Syscalls Explained Without the Hype
How direct syscalls actually work in controlled defensive study, why they remain detectable, and what blue teams should look for before buying the next black box.
Read →
Authorized Red Team Phishing: Templates, GoPhish and Ethical Guardrails
How written-scope red team engagements use GoPhish, build believable templates, and why firing a campaign without authorization ends careers.
Read →
Lateral Movement in the Lab: SMB, WMI and WinRM with a Detection Focus
We reproduce three classic lateral movement techniques in GOAD and show how to turn each one into a Sigma rule the blue team can actually use.
Read →
Personal Crypto: Hardware Wallets, Passphrase and Coercion-Resistant Backup
How to build self-sovereign crypto custody using a hardware wallet, BIP39 passphrase and metal backup designed against phishing and physical attacks.
Read →
Purple Team in Practice: Building a Red vs Blue Feedback Loop
How to integrate adversarial emulation with the SOC, close detection gaps in short sprints, and turn exercises into versioned Sigma rules.
Read →
Simulated Initial Access: Macros, LNK and ISO in an Isolated Windows 11 Lab
We replayed three classic initial access vectors inside a sealed Windows 11 lab to see what the EDR actually logs and where detection quietly falls apart.
Read →
Passwords and MFA: Moving to Passkeys Without Breaking Your Recovery
Passkeys kill phishing and MFA fatigue, but a sloppy migration locks legitimate users out. Plan fallback, devices and roaming with no holes.
Read →
Adversary Emulation with Caldera and MITRE ATT&CK in a Corporate Lab
How Basilisk uses Caldera, Atomic Red Team and MITRE ATT&CK to simulate real TTPs in a closed lab and measure SOC maturity without breaking production.
Read →
Building C2 Infra with Sliver in an Isolated Lab for Defensive Research
Spinning up a Sliver C2 air-gapped is not hacker theater: it is how Blue Teams learn to detect what they will face tomorrow. Hands-on technical walkthrough.
Read →
Active Directory Pentest: Step-by-Step Kerberoasting in a GOAD Lab
Ethical Kerberoasting walkthrough on Game of Active Directory: TGS capture, offline crack with hashcat, and detection via Event ID 4769.
Read →