Wazuh and Its XDR Approach

Monitors and reports key system activity via the Windows event log.

Sysmon can be extremely powerful if applied correctly. If not, it will be a data avalanche and/or a massive network traffic burst.

Sysmon+ElasticSearch+ArangoDB+Fun!

您有一份周报待查收......

evilginx3 + gophish. Contribute to fin3ss3g0d/evilgophish development by creating an account on GitHub.

A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework. - blueteam0ps/memOptix

DLL hijacking (T1574) is one of the favorite techniques used by attackers. In this post, I’ll explain a method for hunting and detection

Anyone who is reading the news nowadays will realize that these are financially trying times for everyone. Due to several global crises…

技术文章是能够有效锻炼表达能力和进行技术积累的方法。与单纯的技术笔记不同，我认为的技术文章应该是对实际的问题或新技术思路的解决方案，而不是技术点的简单堆砌。 对于如何写一篇我认为合格的技术文章， 最近做了一些思考，本篇文章会探讨我写文章时的一些思路和步骤，以及工具推荐和CI/CD自动化发布的实现。