THE KNOWLEDGE LIBRARY
Threat hunting playbooks, practical guides, and perspectives for defenders.
72 articles in the library
Threat Hunting Playbooks
Case file TH-006. Nobody installed anything. No malware hit the disk, no suspicious logon tripped an alert, and the user's MFA is intact. Yet for three weeks, every email that landed in…
Cyber news
🗂️ CASE FILE — September 28, 2026 Lead story: Singapore telecom operator SIMBA confirmed a data breach exposing the personal details of 23,549 customers — names, NRIC identity card numbers,…
Threat Hunting Playbooks
At 09:12 the user signed in from Toronto. At 09:47 the same user signed in from Lagos. Commercial flight time between the two cities: roughly twelve hours. The user does not own a…
Threat Hunting Playbooks
There is a special kind of silence on an IIS server right after it has been compromised: the site still serves pages, the app pool still recycles on schedule, and the only thing that…
Cyber news
🗂️ CASE FILE — September 27, 2026 Lead story: Crypto exchange Bitget disclosed that attackers drained approximately $351.6 million from hot and warm wallets on September 24 — without ever…
Threat Hunting Playbooks
The ticket was legitimate. The request was legitimate. That is exactly why Kerberoasting is so hard to spot — the attacker never forges anything, never touches LSASS, never trips an AV…
Threat Hunting Playbooks
Case file: the channel nobody watches DNS is the most trusted protocol on the network. Firewalls let it through, proxies often ignore it, and almost nobody inspects the content of queries —…
Cyber news
🗂️ CASE FILE — September 26, 2026 Lead story: ShinyHunters breached the Clop ransomware gang's own data leak site by exploiting an unpatched Grav CMS path traversal flaw (CVE-2026-42608) —…
Threat Hunting Playbooks
Case file: the quiet step before the loud one Ransomware is loud. The ransom note, the encrypted extensions, the help-desk tickets — nobody misses detonation. But the steps before…
Threat Hunting Playbooks
Case file: the payload that hides in plain sight PowerShell is a system administrator's best friend and an incident responder's recurring nightmare. In case after case, the initial access…
Cyber news
🗂️ CASE FILE — September 25, 2026 Lead story: Bitget crypto exchange discloses a $351.6 million theft from its hot and warm wallets — the company links the attack to suspected North Korean…
Threat Hunting Playbooks
Case file: persistence via Scheduled Tasks You've contained the initial access. The phishing payload is deleted, the malicious process is dead, the EDR console shows the endpoint "clean."…
