100 detection use cases, each built out from start to finish: threat scenario → required logs → building blocks → rule logic → alert → incident → analyst response.

Covers:
🔐 Identity & MFA abuse
👑 Privileged access, AD & PAM
☁️ Cloud, SaaS & OAuth
📧 Email & BEC
💻 Endpoint & malware
🌐 Network & perimeter
📤 Data leakage & insider threat
🔒 Ransomware
🤖 AI agents & AI tool misuse

Rule examples in KQL, SPL, AQL, Sigma and EQL, plus MITRE ATT&CK mapping and tuning notes.

Its main point: fewer, better alerts, not more of them.

Useful for SOC analysts, detection engineers, and anyone building SIEM rules.

Git feels foggy for a lot of people. Staging, commit, push, origin, HEAD… none of it clicks until someone explains it plainly.

So I made a free guide: Stop Uploading Your Code Through the Browser: Git & GitHub 101
Inside:
▫️ Git vs GitHub: finally not the same thing in your head
▫️ Commit vs push, explained in one sentence
▫️ Logging in from the terminal (your password won't work, here's why)
▫️ Putting any local project on GitHub, public or private
▫️ How not to leak your .env and API keys
▫️ Going back to old versions when you break something
▫️ The error messages everyone panics about, decoded
▫️ Cheat sheet + 8 practice tasks

No jargon. Open a terminal and follow along.

📎 PDF below.

Coffee. Taxi. Lunch. Coffee.
End of month: "Where did the money go?"

Other apps are tedious and the AI ones send your data to the cloud.

Vocash fixes both — send a voice note, it logs itself.
"taxi 20k" → transcribed, classified, saved.

Fully offline. No cloud, no server

forensics room: a VeraCrypt container, a PGP key and an intercepted Moriarty email. goal is to find the general, the meeting place and the time.

covered in the writeup:
▫️ picking the right hashcat mode for a VeraCrypt container
▫️ decoy volume vs hidden volume
▫️ using a file from the decoy as the keyfile
▫️ ROT47, Base64, Base85 and a binary clock

— HTML sanitized, JS off, strict CSP
— Remote images/tracking pixels blocked until "Load Images"
— Links open in own browser
— Raw source via Ctrl+U
— Attachments, light/dark, drag & drop, --watch

BlueShift exposes the host as a Bluetooth LE HID device (GATT) to the target. Toggle input with Ctrl + Alt + S. No Wi-Fi or IP required.

Reads /dev/input directly, supporting Wayland and X11. Control reverts to the host if the target disconnects.

PROCity draws every running Linux process as a building. Height is memory, colour is CPU load, refreshed every second. New processes rise out of the ground, exited ones collapse. Click a building to see its PID, parent, user, threads and command line.

FastAPI and psutil on the backend, Three.js on the front. 1000+ buildings render in a single instanced draw call.

Read-only and local: it listens on 127.0.0.1, needs no root, and never kills or touches a process.

audit.log doesn't read like a normal log. One action, like a file being opened, gets written as several records (SYSCALL, PATH, CWD...) that share one event ID. grep shows you scattered pieces. ausearch matches the whole event and prints it together.

The flags you'll actually use:
-m event type (USER_LOGIN, USER_CMD...)
-sv did it succeed: yes / no
-ts from when: today, recent (10 min), boot
-k the key you tagged an audit rule with
-i show names instead of numbers (uid=1000 → your username)

ausearch -m USER_LOGIN -sv no -ts today -i

ausearch -m USER_CMD -ts today -i

ausearch -k passwd_watch -i

linPEAS searches the whole system for you: weak settings, forgotten passwords, outdated software. Then it points at the way up, in colour.

Red/yellow = that's your way in.

One command, a few minutes, zero setup. You don't need to know what to look for. linPEAS already does.

Basically a cheat sheet that reads the machine for you.

StegoToolkit puts the whole stego workflow in one browser tab. Hide a message inside an image, audio, a PDF, even a QR code, or pull one out. 70+ tools, 20+ formats.

The useful part for CTFs is the Forensics Lab. Drop a file in and it tells you what the file really is, whatever the extension claims. It pulls out readable strings, shows the raw bytes, takes PNGs apart chunk by chunk and points out anything that looks like a flag.

Everything runs in your browser. Files never get uploaded, no account needed.

Three Windows artifacts worth knowing:

$MFT (Master File Table)
Stores file names, sizes, timestamps, and other metadata. A deleted file’s record may remain until it ge
ts reused.

USN Journal
Records file changes, including creation, renaming, and deletion. It can preserve earlier activity after the MFT record has been reused.

Prefetch
Can show that a program ran, its recorded run times, and files referenced during execution.

A simple way to connect them:

MFT → What file was there?
USN Journal → What happened to it?
Prefetch → Did the program run?