Featured
How to read a stealer log: the anatomy of one line
What sits inside an infostealer record, what each field tells you and in what order to triage it.
Blog
Notes from the team
Short answers to questions we meet in the field: reading stealer logs, catching typosquats, managing IOCs, closing cases. Research, operations and product notes.
Why the attack surface inventory is always incomplete
An inventory is a process, not a spreadsheet. Any subdomain without a known owner eventually becomes nobody's asset.
What goes wrong when you feed IOCs into a SIEM
An indicator list does not gain value as it grows. Context-free IOCs create work for analysts and become a closed …
Three correct ways to close a case
Resolved, false positive and risk accepted are not the same thing. Getting the distinction right determines what your report says …
Why a password reset is not enough when a session cookie leaks
A valid session cookie removes the attacker's need for both the password and MFA. Case closure starts with session revocation.
Catching typosquatting domains from certificate logs
Most fake domains obtain a certificate before they go live. That is a window to see the campaign before its …
How to read ransomware leak sites properly
Leak sites are a marketing channel, not a victim list. Taking their numbers at face value produces wrong conclusions.
Measuring supplier risk from outside instead of by questionnaire
An annual supplier questionnaire starts ageing the moment the contract is signed. The externally visible surface can be measured continuously.
Attaching MITRE ATT&CK to a report is not enough
Listing technique IDs is not a coverage analysis. The real question is whether that technique is visible in your environment.
The hard part of choosing keywords for dark web monitoring
Searching the company name is the easiest and least productive method. Yield lives in terms that are specific and hard …
Executive protection: the most expensive form of impersonation
Fake executive accounts exploit hierarchy, not a technical flaw. That is why technical controls do not stop them.
Dangling subdomains: the quietest exposure
When a DNS record outlives the resource behind it, someone else can claim the name. Nobody notices, because nothing breaks.
Who is going to read this threat intelligence report?
The same finding cannot be told to a SOC analyst and a board in one document. A report that does …