RESEARCH

Research.

Detection-engineering walkthroughs, threat analysis, and mitigation guides. Sourced, reproducible, and defensive in scope. One published so far — this index grows as writeups ship.

DETECTION ENGINEERING
Detecting Kerberoasting: A Practical Walkthrough with Sigma
How Kerberoasting (MITRE ATT&CK T1558.003) works, why RC4 service tickets give it away, and three layered Sigma detections — RC4 downgrade, request fan-out, and a honeypot SPN — with tuning and false-positive notes you can run against your own logs.
Jun 10, 2026 · ~14 min read
IN PROGRESS

On the bench: an OWASP LLM Top 10 explainer (prompt injection as a defensive class), a detection guide for a recent CISA KEV-listed CVE, and a writeup on detecting OAuth consent phishing. Want to suggest a topic or flag an error in what's published? Open an issue →