Blue team notes
Detection ideas, investigation prompts, and operational reminders designed to be useful during real work.
The exposed WhatsApp support instructions are a prompt to test chatbot answers, escalation routes and publication controls.
A support assistant can avoid giving legal advice without hiding official options from a user. Test difficult conversations and keep access control outside prompts.
A practical checklist for agent authority, protected logs, shutdown controls and verified recovery.
NIST, NSA and CISA guidance for frontier-system training raises questions every team with autonomous workflows should rehearse: what can the agent reach, what records remain, who can halt it, and what proves recovery?
A practical way to turn Windows account, group, logon, and lockout events into useful monitoring without drowning the SOC in noise.
Start with reliable audit coverage, then add identity, asset, timing, source, and change context. The strongest detections explain what changed, why it is unusual, and what the analyst should investigate next.
A structured approach to scoping assessments, mapping assets and trust, testing realistic attack paths, validating exposure, and connecting technical evidence to business impact.
Start with the decision the assessment must support, follow services through their technology and identity dependencies, validate important findings safely, and turn the result into accountable treatment and evidence-backed closure.
A practitioner reading note on CSPM: how continuous cloud inventory, configuration checks, risk context, ownership, and remediation fit together.
CSPM is most useful when it becomes an operating loop—not another alert console. Start with visibility and read-only access, prioritize findings using exposure and business context, assign accountable owners, verify remediation, and measure whether risk is actually falling.
A risk-based operating model for moving from asset visibility and discovery to verified remediation and governance.
Build a decision system around asset criticality, exposure, exploitability, accountable ownership, safe treatment, and evidence-backed closure—then mature it through a practical 30-60-90 day rollout.
Understanding processes, services, and cronjobs is fundamental to understanding the inner workings of Linux systems.
A practical field note on using ps, lsof, pstree, cron artefacts, and pspy to inspect running processes, trace parent-child relationships, and identify suspicious execution.
Correlate script content, process ancestry, identity context, and network behaviour to separate abuse from routine administration.
A practical hunt that moves beyond binary-name alerts: inspect processed script blocks, follow the full parent chain, connect execution to outbound activity, and combine weak signals into a stronger case.
A new authentication method can be routine maintenance—or an attacker-controlled route back into a compromised account.
Reconstruct the authorising session, compare the event with the user’s normal baseline, correlate nearby identity changes, validate out of band, and contain the entire account when legitimacy cannot be confirmed.
New source infrastructure or resource access may expose misuse of application credentials.
Build a baseline by principal, source network, resource, and time. Investigate first-seen combinations and privilege changes.
Malicious applications can gain access without collecting a user’s password.
Review consent events, requested scopes, publisher verification, redirect URIs, and subsequent API activity.