A hands-on walkthrough of rebuilding the Midnight Blizzard OAuth attack chain in Azure and developing an eviction plan for it.

Analyzing the Midnight Blizzard Eviction Plan

If you are searching for technical information on how browser hijacking works, some generic removal instructions is all you'll probably find. Let's change that.

Browser Hijacking: Three Technique Studies

Analyzing the unsafe chroot behavior of sudo CVE-2025-32463

Guide to understanding, ingesting, and leveraging Microsoft Graph API Activity logs for security operations and detection engineering.

Graph Api Overwhelm

Analyzing the prolific malware loader that loves AutoIt.

Darkgate 3: Return of the Temp

Reverse engineering Windows Defender Detection History (WDDH) files to understand their binary structure and develop a Python parsing tool. Covers methodology from identifying data sources in MsMpEng.exe to creating a standalone CLI parser for DFIR investigations.

Digging into Windows Defender Detection History (WDDH)

A reference document style blog covering Dameware Remote Everywhere rmm tool and its features from an incident response perspective.

Dameware Remote Everywhere Log Reference

Practical tour of DSC v1.1–v3.1: a PowerShell example, Azure Machine Configuration gotchas/deprecations, and a concise feature matrix—plus notes from building a Terraform-provisioned Windows detection lab.

Desired State Configurations

Opened a Can of XWorms

A brief report on the num2words PyPI supply-chain compromise that distributed Scavenger malware. It details how a malicious update (v0.5.15 and v0.5.16) injected Windows DLL-loading code into __init__.py, executing the Scavenger Loader which connects to new C2 servers, steals .pypirc credentials, and downloads stealer modules. Includes IoCs, C2 info, and credits to researchers who discovered and analyzed the breach.

Scavenger Malware Distributed via num2words PyPI Supply Chain Compromise

How Scavenger rode a compromised npm eslint-config-prettier: loader/stealer internals, anti-analysis + XXTEA C2, Chromium targeting, BeamNG ties, and actionable IOCs (with InvokeRE)

Install Linters, Get Malware - DevSecOps Speedrun Edition

A deep dive into Supper (Interlock RAT) a fileless Windows backdoor linked to Vice Society clarifying public report errors and detailing its C2 protocol, encryption, self-deletion, and reverse shell behavior.

Supper is served

Windows-focused IR checklist mapping key Event IDs to ATT&CK/Kill Chain stages, with GFM checkboxes for triage and a downloadable HTML version—note the latest lives on GitHub.

Incident Response Checklist

Analysis of RedTiger, a python based stealer that leverages Discord to exfiltrate credentials

./knowledge-graph