Discovery
4 items, newest first, including 2 newsletter issues.
Newsletter
Watch it run: the network scan 45+ ransomware groups use
Catch the scan before the encryption. On real lab telemetry, in Defender and Elastic.
Newsletter
Hunt Ransomware Before It Encrypts: The Three Tools 45+ Gangs Reach For
As of May 2026, 3,734 organizations have been hit by ransomware.
Discovery using nltest, net and whoami
Learn how adversaries run nltest, whoami, and net for AD recon, with ready Sigma detections and process context to detect and triage.
LSASS Dump via comsvcs.dll: Defender Detection Guide
Detect LSASS dump with comsvcs.dll and rundll32. Clear command breakdown and Sigma mappings for Defender and Elastic
