How to read a stealer log: the anatomy of one line
What sits inside an infostealer record, what each field tells you and in what order to triage it.
Blog
Notes from the team
Short answers to questions we meet in the field: reading stealer logs, catching typosquats, managing IOCs, closing cases. Research, operations and product notes.
Why a password reset is not enough when a session cookie leaks
A valid session cookie removes the attacker's need for both the password and MFA. Case closure starts with session revocation.
Limits of processing leaked data under Turkish data protection law
Examining leaked data does not mean storing it without limit. Purpose, retention and access must be written down up front.
Five questions before you close a case
Closure is the most rushed step of a case. Five questions stop the same finding coming back three months later.