TLTirthak Likharintirthaklikhar.hashnode.dev·3d ago · 22 min readClimbing the Pyramid of Pain: From Hashes to TTP-Based DetectionAuthor's note: This article explains the defensive reasoning and security concepts behind the TryHackMe Summit room. It deliberately omits flags and is not intended to be an answer guide. A security 00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·5d ago · 6 min readThe MITRE ATT&CK most people are learning was retired in October 2025.What v18 and v19 changed, and how to read the framework now. Last week someone messaged me asking a simple question: what should they read to understand MITRE ATT&CK properly, beyond my blog posts and00
JJebitokinsharonjebitok.com·6d ago · 20 min readIntro to Detection Engineering (TryHackMe)Link to the challenge on TryHackMe: Intro to Detection Engineering Introduction Detection engineering is an important role and task for a security analyst. It involves developing processes that will g00
MLManju Lalwaniinmavericksec.hashnode.dev·Aug 30 · 6 min readBuilding a Modular Kubernetes Deception Tool [kube-coy]Introduction Modern Kubernetes environments are complex, dynamic, and increasingly targeted by attackers. Once they breach the perimeter — often through misconfigurations or exposed credentials — atta00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·Aug 18 · 12 min readAnatomy of an identity compromiseWhy nothing fired When a detection misses, the first instinct is to blame the rule. Wrong threshold, wrong table, wrong logic. Sometimes that is exactly right. But there is a class of intrusion where 00
NONetomize Official Bloginblog.netomize.ca·Aug 14 · 12 min readDetect ICMP-Ghost Implant ICMP and DNS Tunnelling C2 Traffic Using PacketSmith Yara-X & ICMP Detection ModulesIntroduction ICMP-Ghost is an open-source tunnelling framework written in pure x64 assembly. What stands out about this framework, compared to other closed- and open-source ones, is the author's claim06J
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 10 · 35 min readTryHackMe : Overflow The Jackpot writeup# Challenge Category Flag 1 B1t Recovery Crypto THM{[REDACTED]} 2 Lost Fortune Included Web THM{REDACTED} 3 Casino Heist Forensics THM{REDACTED} 4 Fresh Powder - Bonus Challenge Detection Eng10
KDKajal Dhanjalinkajalbuilds.hashnode.dev·Aug 5 · 9 min readWhat your logs can't seeThe premise "A detection rule can only fire on evidence that reached the platform." That sounds obvious written down, and it's routinely skipped in practice. When coverage gets audited, it gets audite00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·Jul 21 · 14 min readFortiBleed had around twenty people. JadePuffer had an agent. The way in was identical.The thesis I had to throw out Two intrusions dominated the last month, and the coverage of both led with AI. FortiBleed: an initial-access operation running on around twenty people with a defined div00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·Jun 30 · 4 min readBuilding a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just AttackersRepo: github.com/Kajal-Dhanjal/sentinel-detection-lab Most process-lineage detections in SOC content are written to catch attackers—Office spawning PowerShell, a browser spawning cmd.exe. Part 8 is th00
