Field notes
Tradecraft, detection engineering, and the research behind both.
Featured · Red teamKerberoasting is not dead — it just moved to the cloud
Hybrid identity blurred the line between AD and Entra. Here's how a crackable ticket still gets issued, and the one log that gives the attacker away.
All field notes
- Blue team
Detecting CI/CD pivots before they reach prod
A runner with too many secrets is a foothold. Three detections that fire the moment a pipeline starts acting like an attacker.
- Purple team
From red-team finding to a tested Sigma rule in an afternoon
The handoff is where most assessments die. A workflow for shipping a durable detection alongside every critical finding.
- Tradecraft
Every evasion technique has an expiry date
Evasion is not a product. But emulation means living in memory — a teardown of the techniques, and exactly where each one breaks.
- Research
The forgotten VPN: enumerating shadow IT from the outside
Every org has one. A repeatable recon pass that finds the box nobody owns before somebody else does.
- Purple team
Tabletop is theatre. Run an assumed-breach instead.
How to design an exercise responders can't pass on muscle memory, and what is worth measuring when it is over.