Malware & C2 Dynamic Malware Analysis in a Sandbox: A Practical Behavioral Workflow
A hands-on guide to dynamic malware analysis with Procmon, Process Hacker, and Wireshark, plus Blue Team detection.
2025-10
Malware & C2 
Malware & C2 Unpacking Packed Malware: From UPX to Custom Packers
A hands-on guide to manually unpacking UPX and custom packers using entropy, OEP detection, x64dbg, and Scylla import rebuild.
Malware & C2 Windows Shellcode: Writing and Analyzing Position-Independent Payloads
Build a position-independent Windows shellcode with PEB walking and API hashing, then dissect it with scdbg and a debugger.
Malware & C2 Process Injection Internals: DLL Injection, Reflective Loading, and Process Hollowing
A practical breakdown of classic DLL injection, reflective loading, and process hollowing on Windows, plus blue-team detection.
Malware & C2 Writing Effective YARA Detection Rules
A practical guide to writing precise YARA rules using strings, hex patterns, imphash, and conditions for malware detection.
Malware & C2 C2 Frameworks Explained: Cobalt Strike, Sliver, and Mythic
A practical tour of Cobalt Strike, Sliver, and Mythic — beacons, listeners, malleable profiles, redirectors, and OPSEC for red and blue teams.
Malware & C2 Dissecting Malicious Office Documents: VBA Macros, Stomping, and IOC Extraction
A hands-on guide to triaging malicious Office maldocs with oletools, defeating VBA stomping, and extracting IOCs.
Tools & Defense Hunting Windows Persistence: From Autoruns to WMI Event Subscriptions
A practical guide to planting, detecting, and analyzing Windows persistence across registry, services, tasks, and WMI.
Cloud Security AWS IAM Privilege Escalation Paths: From Low-Priv Credentials to Account Takeover
A practical look at common AWS IAM privilege escalation paths, PoC commands, and the blue-team controls that shut them down.
Cloud Security Attacking and Securing Amazon S3: Buckets, Policies, and Presigned URLs
A practical guide to enumerating, exploiting, and hardening Amazon S3 buckets, ACLs, policies, and presigned URLs.
Cloud Security Breaking Serverless: Attacking AWS Lambda from Event Injection to RCE
How attackers turn Lambda event injection into code execution and credential theft, and how blue teams stop it.
Cloud Security Enumerating and Exploiting AWS with Pacu
A practical walkthrough of using Pacu to enumerate AWS identities, IAM permissions, and discover privilege escalation paths.
Cloud Security Azure & Entra ID Attack Paths: Hunting Privilege Escalation with AzureHound
Advanced Entra ID attack paths: AzureHound enumeration, role assignment abuse, dynamic group injection, and OAuth consent grants.
Cloud Security Abusing Azure Managed Identities: From IMDS Token Theft to ARM Takeover
How attackers steal IMDS access tokens from Azure Managed Identities and pivot into the ARM API, plus blue-team detection.
Cloud Security GCP Privilege Escalation: Abusing Service Account Impersonation and IAM Misconfigurations
How attackers abuse actAs, setIamPolicy, and service account impersonation to escalate privileges in Google Cloud, with blue-team defenses.