Blog
Threat hunting and detection engineering, written down: the reporting behind rules, the telemetry that feeds them, and the gaps that get attackers through.
9 articles
Threat IntelligenceWhat Is Operational Threat Intelligence?
AnyDesk, Fleetdeck.io, Level.io, Mimikatz, Ngrok, Pulseway, Screenconnect, Splashtop, Tactical.RMM, Tailscale, TeamViewer and Teleport.sh. That is Table 1 of CISA advisory AA23-320A, the legitimate…
2026-07-31 · 10 min read
Threat IntelligenceWhat Is an Indicator of Attack (IOA)?
A SHA-256 hash stops matching the moment the operator recompiles the payload. The way that payload opens LSASS does not change, because the API it needs has been in Windows since Windows XP. That gap…
2026-07-31 · 9 min read
Threat IntelligenceWhat Is an Indicator of Compromise (IOC)?
A SHA-256 hash identifies exactly one file. Flip one byte in that file and the hash is gone, which is why hash-based blocking loses to a recompile. That single property explains most of what an…
2026-07-31 · 10 min read
Threat IntelligenceWhat is an advanced persistent threat (APT)?
In one compromise, Volt Typhoon likely extracted NTDS.dit from three domain controllers over a four-year period. CISA, the NSA and the FBI published that detail in advisory AA24-038A in February…
2026-07-31 · 9 min read
Threat IntelligenceWhat Is Cyber Threat Intelligence (CTI)?
CISA advisory AA23-144A, published 24 May 2023, contains this command line, attributed to a PRC state-sponsored actor on a domain controller: "cmd.exe" /c wmic process call create "cmd.exe /c mkdir…
2026-07-31 · 9 min read
Threat IntelligenceWhat Is an APT Campaign?
SUNBURST does nothing for the first 12 to 14 days after its DLL is written to disk. FireEye documented that the exact threshold is picked at random from that interval, and that the backdoor keeps…
2026-07-31 · 8 min read
Threat IntelligenceWhat Is TTP in Cybersecurity?
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 748 C:\Windows\Temp\l.dmp full That one line answers three separate questions. Most writing about TTPs answers one of them and calls it three.…
2026-07-31 · 9 min read
Threat IntelligenceWhat Is Strategic Threat Intelligence?
ICD 203 fixes seven terms for likelihood, running from "almost no chance" at 01-05 percent to "almost certain" at 95-99 percent. A strategic threat intelligence product that uses none of them is not…
2026-07-31 · 10 min read
Threat IntelligenceWhat Is Tactical Threat Intelligence? From Report to Rule
cmd.exe /c "netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=9999 connectaddress=<rfc1918 internal ip> connectport=8443 protocol=tcp" That is tactical threat intelligence. It…
2026-07-31 · 9 min read