Blog
Practical notes from the blue team: detections, investigations, tooling and analysis of real-world incidents.
Latest 2 Nov 2026 · 8 min read
When hackers turned supermarket freezers into ovens: Europe's refrigeration attacks explained
Two waves of attacks heated supermarket fridges to 50°C in France, then in Belgium, Luxembourg, Sweden, Estonia and Ireland. What happened, how internet-exposed refrigeration controllers were abused, and what SOC and OT teams should do now.
- #ot-security
- #incident-analysis
- #critical-infrastructure
- #ics
- #news
2 Nov 2026 · 4 min read
Sysmon Event ID 13: catching registry persistence before it survives a reboot
What Sysmon Event ID 13 records, which registry keys attackers use to persist on Windows, and the Splunk searches I use to find them without drowning in noise.
- #sysmon
- #splunk
- #windows
2 Nov 2026 · 4 min read
Analysing a phishing email with CyberChef: recipes that save time
A practical walkthrough of phishing triage with CyberChef: extracting and defanging URLs, decoding Base64 and quoted-printable bodies, unpacking encoded PowerShell, and hashing attachments safely.
- #phishing
- #cyberchef
- #email-security
2 Nov 2026 · 4 min read
Mapping an incident to MITRE ATT&CK: a practical guide for SOC analysts
How to turn raw investigation notes into an accurate MITRE ATT&CK mapping, with a worked example from phishing email to ransomware staging, common mistakes, and how to use the result for detection gaps.
- #mitre-attack
- #incident-response
- #threat-intelligence
2 Nov 2026 · 3 min read
Automating IOC enrichment with Python and the VirusTotal API
A small, production-minded Python script that takes a list of hashes, domains and IPs, looks them up in VirusTotal, respects rate limits and writes a CSV you can attach to a ticket.
- #python
- #automation
- #threat-intelligence
2 Nov 2026 · 4 min read
Windows logon types every SOC analyst should know (Event IDs 4624 and 4625)
A field guide to Windows logon types 2 to 11: what each one means, which ones point to RDP, lateral movement or brute force, and Splunk searches to hunt with them.
- #windows
- #event-logs
- #splunk
2 Nov 2026 · 1 min read
Hello, world
New domain, new site, and a terminal that actually works.
- #meta
Topics
- #authentication
- #automation
- #critical-infrastructure
- #cyberchef
- #detection-engineering
- #email-security
- #event-logs
- #ics
- #incident-analysis
- #incident-response
- #meta
- #mitre-attack
- #news
- #ot-security
- #persistence
- #phishing
- #python
- #reporting
- #soc
- #splunk
- #sysmon
- #threat-intelligence
- #triage
- #virustotal
- #windows
Subscribe via RSS to get new posts.