Detection-engineering walkthroughs, threat analysis, and mitigation guides. Sourced, reproducible, and defensive in scope. Seven published so far - this index grows as writeups ship.
SafePay is a centralized ransomware crew now claiming Australian victims, and real-estate agencies fit its target profile almost perfectly - data-rich, cash-handling, thinly defended, and spread across franchise offices under one brand. The playbook stage by stage - edge devices, infostealer-harvested logins, living-off-the-land movement, commodity exfiltration - mapped to the Essential Eight controls that break each link.
INC Ransom is a RaaS crew actively claiming Australian victims, and the firms it lands on look a lot like yours. The affiliate playbook stage by stage - phishing, unpatched edge devices, bought credentials, living-off-the-land movement, commodity exfiltration - mapped to the Essential Eight controls that break each link in the chain.
The moment you give a model tools, its output stops being text and becomes actions. The agent threat surface - excessive agency, indirect injection via tool output, the MCP supply chain, the confused-deputy identity problem - what to log, and the detections and containment architecture that keep one bad instruction from becoming an incident.
An authenticated command injection in LiteLLM's MCP preview endpoints - in CISA KEV and actively exploited - that chains with the Starlette "BadHost" bug (CVE-2026-48710) into unauthenticated RCE. The mechanism, what to log, and two runnable Sigma rules with tuning notes.
The OWASP LLM Top 10 read as a defender's checklist: why prompt injection has no patch, the "lethal trifecta" behind incidents like EchoLeak (CVE-2025-32711), what to log in LLM-integrated apps, and canary, egress, and behavioral detections you can deploy today.
The phishing class that never asks for a password and sails through MFA - illicit OAuth consent grants (MITRE ATT&CK T1528) in Entra ID, the audit-log artifacts they leave, and KQL detections with tuning notes.
How Kerberoasting (MITRE ATT&CK T1558.003) works, why RC4 service tickets give it away, and three layered Sigma detections - RC4 downgrade, request fan-out, and a honeypot SPN - with tuning and false-positive notes you can run against your own logs.
New writeups ship as the threats worth covering surface. Want to suggest a topic, request a detection, or flag an error in what's published? Open an issue →