research blog

Threat hunting.
The most sophisticated actors.

Technical research across DFIR, malware analysis, threat hunting, and CTF write-ups. No product pitches, no fluff.

filter: all dfir hackthebox malware analysis threat hunting
Threat Hunting 10 Sep 2026
When the Reviewer and the Reviewed Are the Same Model: Adversarial Verification for LLM-Assisted Analysis
A model asked to review its own analysis drifts toward agreement, and six reviewer personas in one pass drift together. This covers why it happens, the panel structure and blind second reviewer that counter it, and what planted-defect testing actually showed. The full panel is included as a download.
→
Threat Hunting 21 Jun 2026
Hunting Sleeping Giants: Detecting Encrypted Beacon Sleep Obfuscation
How Gargoyle, FOLIAGE and Ekko implement sleep obfuscation — and the detection layers that catch them. Primary source: Kyle Avery DEF CON 30.
→
DFIR 24 May 2026
Automating Memory Analysis with Volatility: One Script, Complete Results
A complete guide to automating single memory image analysis with Volatility 2 and 3. Covers when to use each version, parallel plugin collection, anomaly detection logic, IOC extraction, Yara scanning, and a full pipeline that produces an HTML report and structured JSON from a single command. Supports both Windows and Linux images.
→
Threat Hunting 14 May 2026
Running a Local LLM for Threat Hunting: Setup, Models, and Real Workflows
A complete guide to setting up a local large language model for security work across three hardware tiers: Apple Silicon, consumer GPU, and CPU-only. Covers Ollama, Open WebUI, model selection, and practical threat hunting workflows including log analysis, Sigma rule generation, and VQL assistance.
→
DFIR 12 May 2026
Velociraptor Process Injection Hunting: Full Investigation Enrichment
Enriching Velociraptor injection findings by cross-referencing memory images, Windows event logs, filesystem artefacts, Zeek network telemetry, and lateral movement indicators into a complete investigation narrative.
→
Threat Hunting 7 May 2026
Thinking Like an Adversary: Using ATT&CK to Build a Threat Hunt Scope
Effective threat hunting starts before you open the SIEM. This covers how to think through attacker decision-making, map realistic technique selections to your specific environment, build a coverage gap analysis against MITRE ATT&CK, and convert the gaps into a prioritised, testable hunt plan.
→
DFIR 5 May 2026
Velociraptor Process Injection Hunting: Finding Executables Not Backed by Disk
A complete walkthrough of using Velociraptor VQL to detect process injection by finding anonymous executable memory regions, PE headers loaded without disk backing, and active threads executing injected code. Includes a full reusable hunt artefact.
→
Threat Hunting 28 Apr 2026
Kernel-Level EDR Tampering: How Attackers Remove Your Visibility at the Source
Beyond BYOVD, attackers have multiple methods to tamper with EDR at the kernel level: callback removal, minifilter bypass, ETW provider patching, and kernel object manipulation. Each requires different detection approaches. This covers all of them.
→
Threat Hunting 21 Apr 2026
Supply Chain Attacks and Trusted Binary Abuse: When Your Own Software is the Threat
Supply chain attacks compromise software before it reaches you. Trusted binary abuse exploits legitimately signed executables to deliver malicious payloads. Both are among the hardest techniques to detect because the initial indicator is valid software doing what it is supposed to do.
→
Threat Hunting 14 Apr 2026
Golden Tickets, Silver Tickets, and Diamond Tickets: Forged Kerberos and How to Detect Them
A Golden Ticket forged with the krbtgt hash grants unlimited access to every service in the domain for 10 years. Silver Tickets are service-specific but require no DC contact at all. Diamond Tickets are a newer variant designed to evade Golden Ticket detection. This covers detection for all three.
→