A primitive-by-primitive teardown of why hooking WriteProcessMemory is a brittle foundation for injection detection, covering the alternative memory-write APIs and syscall paths implants actually use plus the ETW, call-stack, and cross-process handle telemetry that keeps working when the hooked…
A detection-engineering walkthrough of the actively exploited Citrix NetScaler zero-day RCE vulnerabilities that watchTowr uncovered, mapping the attack chain from initial exploit to post-exploitation and giving defenders concrete detection logic and mitigations to apply while no patch exists.
A deep technical walkthrough of testing Anthropic's Claude Fable 5 to automate detection rule generation, with emphasis on validation, tuning, and defensive workflow integration.
A lab-driven walkthrough for hardening Active Directory service accounts and building detections against automated Kerberoasting campaigns that exploit SPNs, weak encryption, and service account sprawl.