category

Threat Hunting

filter: all dfir hackthebox malware analysis threat hunting
Threat Hunting 24 Mar 2026
Cross-Domain Identity Attacks: MFA Bypass, Help Desk Social Engineering, and Adversary-in-the-Middle
Vishing attacks increased 442% in the second half of 2024. SCATTERED SPIDER built an entire operation around calling help desks and impersonating employees to reset MFA. AiTM phishing steals session tokens after MFA completes. This covers how each technique works and how to detect them.
→
Threat Hunting 17 Mar 2026
Living Off the Land at Scale: Hunting Attackers Who Blend Into Your Own Tools
81% of interactive intrusions in 2025 involved no malware. Attackers use your own administrative tools against you. Detecting this requires knowing what normal looks like well enough to spot the subtle differences. This is how to build that detection.
→
Threat Hunting 10 Mar 2026
DCSync and DCShadow: Owning Active Directory Without Touching a DC
DCSync replicates every credential in Active Directory without logging on to a domain controller. DCShadow goes further -- it creates a rogue DC and injects objects into AD. Both techniques have specific detection signatures that most environments are not watching for.
→
Threat Hunting 3 Mar 2026
Kerberoasting and Its Modern Variants: Why Classic Detection Still Misses Half the Attacks
Classic Kerberoasting detection looks for RC4 TGS requests. Attackers switched to AES years ago. Targeted Kerberoasting, roasting with machine accounts, and AS-REP roasting all have different signatures. This covers all variants and how to hunt each one.
→
Threat Hunting 24 Feb 2026
BYOVD: Bring Your Own Vulnerable Driver — Killing EDR at the Kernel Level
Bring Your Own Vulnerable Driver is now standard ransomware tradecraft. The attacker loads a legitimate but vulnerable signed driver, uses it to gain kernel execution, and kills your EDR before you know they are there. This is how to hunt for it.
→
Threat Hunting 10 Feb 2026
Getting Started with Zeek for Network Threat Hunting
Zeek is one of those tools that looks overwhelming at first. After a few weeks of using it in a lab environment, here is how I actually got it to a useful state.
→
Threat Hunting 27 Jan 2026
Writing Sigma Rules That Actually Work
A week of trialling Sigma rules against a real lab environment. A lot of public rules are too noisy to be useful without tuning.
→
Threat Hunting 6 Jan 2026
Hunting Cobalt Strike Beacons in Network Traffic
Cobalt Strike is everywhere in incident reports. Understanding the default beacon traffic patterns makes hunting it more approachable than most people expect.
→
Threat Hunting 16 Dec 2025
Writing Your First Yara Rule: From Sample to Signature
Yara rules feel mysterious until you write one from scratch against a real malware sample.
→
Threat Hunting 9 Dec 2025
Malicious PowerShell: What to Look For and Where to Find It
PowerShell is used in almost every modern intrusion at some point. Covering the logging setup you need and how to cut through the noise.
→