Detection Engineering
12 Jan 2022
WMI Event Consumers: what are you missing?
Find WMI event consumers that common collection methods miss, including persistence in custom namespaces. Covers collection and detection with Velociraptor.
29 May 2019
Compare YARA and PowerShell approaches to finding renamed executables on disk, with code examples and detection limitations.
12 May 2019
Blue Team Hacks - Binary Rename
Detect renamed Windows binaries by comparing executable metadata with process names and paths. Includes a proof of concept and its limitations.
2 Apr 2018
Compare PowerShell download cradles and their network and endpoint traces, with test scripts to help assess detection coverage.
3 Apr 2017
Blue Team Hacks - WMI Eventing
Use WMI event subscriptions to monitor processes and trigger file collection on older Windows systems with visibility gaps.