Blog
Supply Chain SecurityWhat Is Dependency Confusion?
pip install --extra-index-url https://pypi.internal.example.com/simple internal-auth-lib queries two indexes at once. pip's own documentation says what happens next. There is no priority in the…
2026-05-1111 min read
Supply Chain SecurityWhat Is Software Supply Chain Security?
Between July 18 and 19, 2026, four versions of a gem called git_credential_manager landed on rubygems.org in roughly nine hours. Version 2.8.0 was already a working dropper. It built a URL against a…
2026-04-268 min read
Malware AnalysisWhat Is Malware Analysis?
sha256sum sample.bin is minute zero. What you do in minute one splits into four methods, and each one has a wall you hit. Static triage reads the file without running it. Hashes, PE header, sections,…
2026-04-178 min read
Security OperationsWhat Is Event Correlation in SIEM?
Windows Security event 4625 on its own is a typo. Thirty of them against thirty different account names from one source address in fifteen minutes, followed by a 4624 from that same address, is a…
2026-04-0610 min read
Detection EngineeringWhat Is a Data Source in Detection Engineering?
Windows event ID 4688 fires on every process creation. The Process Command Line field inside it is empty by default. Microsoft documents this plainly: the field arrived in event version 1 on Windows…
2026-03-187 min read
Detection EngineeringWhat Is a Detection Signal vs Noise?
powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand SQBu... That is a malicious command line in one estate and an Ansible task in the next one over. Ansible's…
2026-03-078 min read
Security OperationsWhat Is Log Normalization in SIEMs?
Sysmon calls it Image. Windows Security event 4688 calls it NewProcessName. Microsoft Defender for Endpoint splits the same thing into FolderPath and FileName. All three describe one executable…
2026-02-268 min read
Detection EngineeringWhat Is Security Telemetry?
Sysmon Event ID 3, network connection, is disabled by default. Microsoft says so in the Sysmon documentation, right above the note that it links every connection to a process through ProcessId and…
2026-02-169 min read
Supply Chain SecurityWhat Is a Software Bill of Materials (SBOM)?
The first question after CVE-2021-44228 went public was not how the JNDI lookup works. It was which of our systems ship log4j-core. Most teams answered it with a fleet-wide find / -name "log4j*.jar",…
2026-01-318 min read
Supply Chain SecurityWhat is a supply-chain attack?
SolarWinds.Orion.Core.BusinessLayer.dll carried a valid SolarWinds Authenticode signature. It also carried SUNBURST. A supply-chain attack is an intrusion where the attacker does not compromise the…
2026-01-1911 min read
Malware AnalysisWhat Is Living off the Land (LotL) in Attacks?
certutil.exe ships on every Windows install, is signed by Microsoft, sits in C:\Windows\System32, and will fetch a file from a URL onto disk. That last part is not a bug. It is what the certificate…
2026-01-169 min read
Malware AnalysisWhat Is Fileless Malware?
Almost nothing is entirely fileless. The DoublePulsar backdoor that EternalBlue installs ends up in kernel memory with no file written, and that is the rare pure case. Everything else people call…
2025-12-307 min read