// — Labs
Field notes
Tradecraft, detection engineering, and the research behind both.
Featured · Red team// — · 5 min read
Kerberoasting is not dead — it just moved to the cloud
Hybrid identity blurred the line between AD and Entra. Here's how a crackable ticket still gets issued, and the one log that gives the attacker away.
Read field note
All field notes
- Blue team
Detecting CI/CD pivots before they reach prod
A runner with too many secrets is a foothold. Three detections that fire the moment a pipeline starts acting like an attacker.
- Purple team
From red-team finding to a tested Sigma rule in an afternoon
The handoff is where most assessments die. A workflow for shipping a durable detection alongside every critical finding.
- Tradecraft
Writing a loader that survives one specific EDR
Evasion is not a product. But emulation means living in memory — a teardown of the techniques, and exactly where each one breaks.