Blue Team

Detection and threat hunting written from the attacker’s perspective. Each post breaks down how a specific attack works, then maps it to detectable artifacts: event IDs, Sysmon fields, and log sources. Understanding the offense is how you build better defense.