Public, well-documented technique. This is about the detection side, not a how-to. Signals that still hold: image n…
lenaetwMEMBERstarted 26 Aug 2025, 14:10msrreadYesterday, 13:58
1 readingWe signed it. Finance survived. The block stayed. This is the whole story and I am posting it because the next pers…
lahfsahfThursday, 08:58
1 readingThe guest was isolated. The host was not. A sample that detected the hypervisor had a path we did not intend — not …
4 readingSSH and a console. RDP stayed off. Convenience is how jump boxes become desktops. If you need a GUI, use a dedicate…
tailcallMEMBERstarted 12 Apr 2026, 02:46
retbleedTuesday, 04:09
2 readingUnplug is not always right. The page says: isolate NIC, snapshot if VM, do not reboot yet, call the human. Reboot i…
fsgsbaseMEMBERstarted 21 Jun 2026, 23:37
serialize23 Aug 2026, 15:41
6 readingTelemetry out of band. Sample sees a network that is fake. Those two sentences are the architecture. Everything els…
kisystemMEMBERstarted 13 Jul 2026, 09:44
aesenc19 Aug 2026, 03:23
2 readingI collect them. I read them when a box 'feels weird'. I do not read them daily. Daily is a lie. If you claim you re…
noreturnMEMBERstarted 29 Dec 2025, 07:58sgdt15 Aug 2026, 23:28
5 readingA provider that should be on, off. That is a hunt. Not every off is malice. Some are our own 'perf' tickets. Invent…
4 readingPeople treat lab boxes as disposable and then reuse them for mail. Disposable means disposable. Reimage, or do not …
hltspinMEMBERstarted 5 Aug 2026, 14:43syscallst7 Aug 2026, 10:23
3 readingInstaller failed with LSA protection on. Vendor said 'turn it off'. We gave them a reboot-and-retry and a ticket to…
peb64MEMBERstarted 5 Feb 2026, 12:38samueljay6 Aug 2026, 23:153 readingI read bypass writeups as detection homework, not as a shopping list. Then I ask: would our telemetry have seen the…
btbaliasMEMBERstarted 20 Jan 2026, 11:31compactmem1 Aug 2026, 12:57
7 readingI printed it. People still asked. I pointed at the sticker. Shared folders stayed off. Physical reminders work on t…
dacover30 Jul 2026, 04:59
10 readingI dump the persistent rules weekly. Anything that is not in the repo is a finding. Two were ours. One was not. Fire…
alignchkMEMBERstarted 27 Jul 2026, 13:39
greybeard28 Jul 2026, 10:50
10 readingWe blocked macros from the internet. The business survived. The FP was one old template. We converted the template.…
hotpathMEMBERstarted 10 Jan 2026, 08:46
ctorsold28 Jul 2026, 02:592 readingThe exception became a NAT. The NAT became a path. I ripped it out and put a ticket in front of any future exceptio…
absaddrMEMBERstarted 12 Dec 2025, 04:12
ibtendbr24 Jul 2026, 23:18
9 readingI revoked it. Things broke. We fixed the things. Local admin stayed gone. Temporary without a calendar invite is pe…
mcestackMEMBERstarted 23 Jul 2026, 19:18rdrand24 Jul 2026, 08:13
7 readingWe turned on CFI on a lab tool and found a callback table we had been sloppy with. Fixed the table. CFI stayed on. …
sharedusrMEMBERstarted 29 Jun 2026, 21:14
umip30 Jun 2026, 19:095 readingExecution policy is not a security boundary. It is a speed bump. We still use it plus WDAC on the jump box. The hel…
vectorcallMEMBERstarted 16 Jun 2026, 08:49
analyzer16 Jun 2026, 23:56
9 readingWe disabled LLMNR and NBT-NS on the lab network. Two old printers complained. We lived. If your lab still broadcast…
fsbase8 Jun 2026, 08:128 readingIt did not. We found out during a detonation. We now rate-limit and we keep a dedicated log volume with alerts at 7…
applyenumMEMBERstarted 30 May 2026, 08:14icedx8630 May 2026, 17:321 readingIR has to open attachments. They open them in a cattle VM that dies every night. Not on the jump box. Not on the la…
undefrngMEMBERstarted 20 May 2026, 07:41invpcid21 May 2026, 04:564 readingNot every fix waits for Tuesday. The forgot-VM problem is worse on out-of-band because the process is 'someone saw …
fixupMEMBERstarted 10 May 2026, 14:06sofia_yr14 May 2026, 09:243 readingSeDebugPrivilege on a kiosk image. It was our own RMM. We removed it. The RMM survived. Inventory privileges. Then …
analyzerMEMBERstarted 27 Apr 2026, 10:33
cr3walk28 Apr 2026, 12:3910 readingA fake updater name in a fake path. If it starts, I want a page. It started once: a curious intern. We talked. The …
languageidMEMBERstarted 22 Apr 2026, 20:20
fidbbuild25 Apr 2026, 00:187 readingThe two we added were old, signed, and we do not need them. The rest of the internet's blocklist is a different ris…
slaspecSENIORstarted 2 Apr 2026, 18:24swapgs4 Apr 2026, 10:305 readingSandbox is a place, not a spell. I tell them: snapshot, no creds, no mail, no shared folders, one-way logs. Then ma…
hexraysMEMBERstarted 22 Mar 2026, 06:04
apclevel23 Mar 2026, 14:006 readingJIT looked like RWX because it was. Signed, expected, noisy. I excepted the publisher + path, not the behavior clas…
katyafid16 Mar 2026, 09:54
9 readingA COM server we needed was also an ASR block. We scoped the block, we did not disable the rule. Scope, do not disab…
svc_idMEMBERstarted 3 Mar 2026, 07:26
gscookie3 Mar 2026, 22:318 readingA laptop jumped to wifi 'for a meeting'. I wrote a control: lab nics do not roam. Then I wrote it again in the rule…
win32uMEMBERstarted 22 Feb 2026, 13:03beacon25 Feb 2026, 02:241 readingPublic technique, patched-class discussion. Image unmap then map with RWX is still loud if you have the right provi…
6 readingSomeone wanted PPL off to debug a service. I gave them a debug build and a second box. PPL stayed on. If your debug…
sibscaleMEMBERstarted 8 Dec 2025, 11:31winload12 Dec 2025, 09:518 readingWe planted fake keys in a fake .env. An intern used them in a test. The canary fired. We promoted the intern for fi…
setnzMEMBERstarted 22 Nov 2025, 18:45hotpath24 Nov 2025, 04:071 readingNo browser, no mail, no Slack. Yes: SSH, WinDbg, git over SSH, a text editor. People complained. Then they got used…
bsrscanMEMBERstarted 16 Nov 2025, 20:32callreg18 Nov 2025, 01:274 readingI keep child-process, executable-from-email, and office-create-child in block on the jump boxes. The rest are audit…
greybeard12 Nov 2025, 18:353 readingIt was not LSASS. It was a service that held a token like a souvenir. Guard what you have, then stop holding souven…
popcntMEMBERstarted 29 Oct 2025, 16:04
nvarstore31 Oct 2025, 20:5410 readingAudit mode for a quarter. The noisy publishers were our own signed-but-weird tools. We fixed the tools. Then we enf…
packedleMEMBERstarted 21 Oct 2025, 18:06
rdtscp22 Oct 2025, 11:317 readingA allow-list entry without an expiry is a vulnerability with a ticket number. 90 days, then re-justify. I deleted 4…
offsetofMEMBERstarted 12 Oct 2025, 07:12asanring14 Oct 2025, 00:162 readingHost-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging. …
labratMEMBERstarted 30 Sep 2025, 17:47rootkit_ivan7 Oct 2025, 18:475 readingI hunt binaries that should have CFG and do not, on a path that should be signed. That is a drift hunt, not a explo…
pltgotMEMBERstarted 23 Sep 2025, 14:04
tebself24 Sep 2025, 15:126 readingCLM on the jump box. Our scripts used a pile of things CLM hates. We rewrote them. Jump box yes, workstation later.…
hashwalkMEMBERstarted 14 Sep 2025, 23:49alpha15 Sep 2025, 17:009 readingA canary file in a path they already ignore, a canary DNS that does not break tests, a canary token in a fake confi…
greyGUESTstarted 4 Sep 2025, 23:18tailcall5 Sep 2025, 12:518 reading