# Security-in-bits

> AI-assisted, human-validated detection engineering and threat hunting, proven on real lab telemetry. Ransomware and RMM abuse in KQL, ES|QL and Sigma.

Every detection here was run against real telemetry from an isolated home lab (Microsoft Defender, Elastic) before
it was published. Queries are KQL, ES|QL and Sigma. Content is AI-assisted and human-validated; where a claim is
observed rather than inferred, the post says so. All content is free to read, quote and cite with attribution.

- [All posts](https://www.securityinbits.com/blog/): the full archive, newest first
- [Detection index](https://www.securityinbits.com/detections/): every detection write-up, filterable by ATT&CK technique
- [About](https://www.securityinbits.com/about/): what "lab-proven" means here
- [Search](https://www.securityinbits.com/search/): client-side search across every post
- [RSS](https://www.securityinbits.com/rss.xml): full-content feed

## Malware Analysis
- [All Malware Analysis posts](https://www.securityinbits.com/category/malware-analysis/): 16 posts
- [Unpack RedLine stealer using dnSpyEx – Part 3](https://www.securityinbits.com/malware-analysis/unpack-redline-stealer-using-dnspyex-part-3/): Dive into unpacking and extracting config from RedLine Stealer using dnSpyEx. This is the 3rd part in our RedLine malware series.
- [Unpack RedLine stealer to extract config using pe-sieve -Part 2](https://www.securityinbits.com/malware-analysis/unpack-redline-stealer-to-extract-config-using-pe-sieve-part-2/): Unpack RedLine stealer to extract config using pe-sieve. pe-sieve dumps then unpacked files from memory. Then, extract the config from the dumped file.
- [🔍 Dive into the RedLine Stealer Infection Chain – Part 1](https://www.securityinbits.com/malware-analysis/%F0%9F%94%8D-dive-into-the-redline-stealer-infection-chain-part-1/): This article talks about RedLine Stealer infection chain which uses LNK, PowerShell, mshta and URLs to download final payload. This include VBScript analysis using CyberChef & Wscript.Echo.
- [AsyncRAT config decryption using CyberChef – Recipe 0x2](https://www.securityinbits.com/tools/cyberchef/asyncrat-config-decryption-using-cyberchef-recipe-2/): Decrypt AsyncRAT configurations effortlessly using CyberChef with our step-by-step guide. Dive into the recipe and enhance your malware analysis skills.
- [AsyncRAT: Config Decryption Techniques and Salt Analysis](https://www.securityinbits.com/malware-analysis/asyncrat-config-decryption-techniques-and-salt-analysis/): Explore AsyncRAT inner workings. Learn unique decryption techniques to enhance your cybersecurity skills today!
- [Interesting tactic by Ratty & Adwind for distribution of JAR appended to signed MSI – CVE-2020-1464](https://www.securityinbits.com/malware-analysis/interesting-tactic-by-ratty-adwind-distribution-of-jar-appended-to-signed-msi/): This article discusses an interesting tactic (CVE-2020-1464) actively used by different Java RAT malware authors like Ratty & Adwind to distribute malicious JAR appended to signed MSI files.
- [Similarity between Qealler/Pyrogenic variants -Part 0x3](https://www.securityinbits.com/malware-analysis/similarity-between-qealler-pyrogenic-variants-part-0x3/): In this last part, we will compare Old Qealler with new Qealler/Pyrogenic variant based on static code analysis.
- [Unpacking Pyrogenic/Qealler using Java agent -Part 0x2](https://www.securityinbits.com/malware-analysis/unpacking/unpacking-pyrogenic-qealler-using-java-agent-part-0x2/): We will learn how and when we can use Java agent to quickly unpack the Pyrogenic/Qealler Infostealer.
- [Qealler Infostealer static analysis – Part 0x1](https://www.securityinbits.com/malware-analysis/pyrogenic-infostealer-static-analysis-part-0x1/): Pyrogenic/Qealler is heavily obfuscated Java based Infostealer which is quiet active based on ANY.RUN and this post will focus on Pyrogenic Infostealer static analysis
- [Parent PID Spoofing (Stage 2) Ataware Ransomware – Part 0x3](https://www.securityinbits.com/malware-analysis/parent-pid-spoofing-stage-2-ataware-ransomware-part-3/): Ataware Ransomware Stage 2 uses Parent PID Spoofing technique to change it parent PID to lsass.exe and download the final Ataware Ransomware.
- [UAC bypass analysis (Stage 1) Ataware Ransomware – Part 0x2](https://www.securityinbits.com/malware-analysis/uac-bypass-analysis-stage-1-ataware-ransomware-part-2/): Ataware Ransomware uses UAC bypass using CMSTPLUA COM interface in ATAPIinit.exe (Stage 1). It was downloaded from Dropbox url when user open the malicious Excel.
- [Excel 4.0 Macro, hta, VBScript & PowerShell Analysis Ataware Ransomware – Part 0x1](https://www.securityinbits.com/malware-analysis/excel-4-0-macro-hta-vbscript-powershell-analysis-ataware-ransomware-part-1/): Excel 4.0 Macro technique with mshta and PowerShell. This will be blog series analysing complete infection chain from Excel to Ataware Ransomware
- [Deobfuscate PowerShell using PowerShell Logging](https://www.securityinbits.com/malware-analysis/deobfuscate-powershell-using-powershell-logging/): Analyze/Deobfuscate malicious PowerShell faster by enabling PowerShell Enhanced logging. Example scenario Using Emotet & Qbot
- [Deobfuscate Emotet PowerShell – Part 0x2](https://www.securityinbits.com/malware-analysis/deobfuscate-emotet-powershell/): Deobfuscate and extract CC from the PowerShell cmd extracted from the Emotet downloader.
- [Deobfuscate malicious macro – Part 0x1](https://www.securityinbits.com/malware-analysis/deobfuscate-malicious-macro/): We will concentrate on malicious macro embedded in Emotet downloader office document and see how to deobfuscate the macro code.
- [Extract strings](https://www.securityinbits.com/malware-analysis/extract-strings/): Extracting strings is important step in malware anlaysis. We will learn how we can extract/interpret strings from malware.

## Detection Engineering
- [All Detection Engineering posts](https://www.securityinbits.com/category/detection-engineering/): 4 posts and 6 newsletter issues
- [wbadmin NTDS.dit dump detection for Domain Controllers](https://www.securityinbits.com/detection-engineering/wbadmin-ntds-dit-dump-detection/): wbadmin NTDS.dit dump detection for DCs using Sigma, MDE KQL, and Elastic plus fast triage with Backup logs.
- [How to set up Sigma rules for Elasticsearch SIEM](https://www.securityinbits.com/detection-engineering/sigma-rules-elasticsearch/): End-to-end workflow to convert Sigma rules into Elasticsearch SIEM detection rules using sigma-cli, Elasticsearch backend, and Kibana NDJSON imports.
- [Discovery using nltest, net and whoami](https://www.securityinbits.com/detection-engineering/nltest-whoami-net-discovery/): Learn how adversaries run nltest, whoami, and net for AD recon, with ready Sigma detections and process context to detect and triage.
- [LSASS Dump via comsvcs.dll: Defender Detection Guide](https://www.securityinbits.com/detection-engineering/lsass-dump-comsvcs-rundll32/): Detect LSASS dump with comsvcs.dll and rundll32. Clear command breakdown and Sigma mappings for Defender and Elastic
- [Load Real Defender Telemetry into a Free ADX Cluster in One Paste](https://newsletter.securityinbits.com/p/load-real-defender-telemetry-into): newsletter, 2026-10-28 - No tenant, no Azure subscription, no credit card. Eight MDE tables from a real lab intrusion, loaded with one script, checked against known row counts.
- [Watch it run: the network scan 45+ ransomware groups use](https://newsletter.securityinbits.com/p/watch-it-run-the-network-scan-45): newsletter, 2026-09-30 - Catch the scan before the encryption. On real lab telemetry, in Defender and Elastic.
- [ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays](https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud): newsletter, 2026-09-23 - Two real samples in my lab dropped two implants on one host. One vendor-signed and loud, one self-hosted and configured to be invisible. Here is how to hunt both.
- [32 Ransomware Groups Abuse AnyDesk. Your EDR Sees a Legit Tool](https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk): newsletter, 2026-07-29 - Is That AnyDesk Legit or Planted? A Lab-Validated Hunt
- [Detecting Reverse SSH SOCKS Tunnels: Separating Benign -R From Akira Pivoting](https://newsletter.securityinbits.com/p/detecting-reverse-ssh-socks-tunnels): newsletter, 2026-06-17 - Two of these three ssh.exe -R sessions are benign. The telemetry that separates them, and the one case it can't.
- [Hunt Ransomware Before It Encrypts: The Three Tools 45+ Gangs Reach For](https://newsletter.securityinbits.com/p/hunt-ransomware-before-it-encrypts): newsletter, 2026-06-06 - As of May 2026, 3,734 organizations have been hit by ransomware.

## Threat Hunting
- [All Threat Hunting posts](https://www.securityinbits.com/category/threat-hunting/): 4 posts and 6 newsletter issues
- [wbadmin NTDS.dit dump detection for Domain Controllers](https://www.securityinbits.com/detection-engineering/wbadmin-ntds-dit-dump-detection/): wbadmin NTDS.dit dump detection for DCs using Sigma, MDE KQL, and Elastic plus fast triage with Backup logs.
- [How to set up Sigma rules for Elasticsearch SIEM](https://www.securityinbits.com/detection-engineering/sigma-rules-elasticsearch/): End-to-end workflow to convert Sigma rules into Elasticsearch SIEM detection rules using sigma-cli, Elasticsearch backend, and Kibana NDJSON imports.
- [Discovery using nltest, net and whoami](https://www.securityinbits.com/detection-engineering/nltest-whoami-net-discovery/): Learn how adversaries run nltest, whoami, and net for AD recon, with ready Sigma detections and process context to detect and triage.
- [LSASS Dump via comsvcs.dll: Defender Detection Guide](https://www.securityinbits.com/detection-engineering/lsass-dump-comsvcs-rundll32/): Detect LSASS dump with comsvcs.dll and rundll32. Clear command breakdown and Sigma mappings for Defender and Elastic
- [Load Real Defender Telemetry into a Free ADX Cluster in One Paste](https://newsletter.securityinbits.com/p/load-real-defender-telemetry-into): newsletter, 2026-10-28 - No tenant, no Azure subscription, no credit card. Eight MDE tables from a real lab intrusion, loaded with one script, checked against known row counts.
- [Watch it run: the network scan 45+ ransomware groups use](https://newsletter.securityinbits.com/p/watch-it-run-the-network-scan-45): newsletter, 2026-09-30 - Catch the scan before the encryption. On real lab telemetry, in Defender and Elastic.
- [ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays](https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud): newsletter, 2026-09-23 - Two real samples in my lab dropped two implants on one host. One vendor-signed and loud, one self-hosted and configured to be invisible. Here is how to hunt both.
- [32 Ransomware Groups Abuse AnyDesk. Your EDR Sees a Legit Tool](https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk): newsletter, 2026-07-29 - Is That AnyDesk Legit or Planted? A Lab-Validated Hunt
- [Detecting Reverse SSH SOCKS Tunnels: Separating Benign -R From Akira Pivoting](https://newsletter.securityinbits.com/p/detecting-reverse-ssh-socks-tunnels): newsletter, 2026-06-17 - Two of these three ssh.exe -R sessions are benign. The telemetry that separates them, and the one case it can't.
- [Hunt Ransomware Before It Encrypts: The Three Tools 45+ Gangs Reach For](https://newsletter.securityinbits.com/p/hunt-ransomware-before-it-encrypts): newsletter, 2026-06-06 - As of May 2026, 3,734 organizations have been hit by ransomware.

## Discovery
- [All Discovery posts](https://www.securityinbits.com/category/discovery/): 2 posts and 2 newsletter issues
- [Discovery using nltest, net and whoami](https://www.securityinbits.com/detection-engineering/nltest-whoami-net-discovery/): Learn how adversaries run nltest, whoami, and net for AD recon, with ready Sigma detections and process context to detect and triage.
- [LSASS Dump via comsvcs.dll: Defender Detection Guide](https://www.securityinbits.com/detection-engineering/lsass-dump-comsvcs-rundll32/): Detect LSASS dump with comsvcs.dll and rundll32. Clear command breakdown and Sigma mappings for Defender and Elastic
- [Watch it run: the network scan 45+ ransomware groups use](https://newsletter.securityinbits.com/p/watch-it-run-the-network-scan-45): newsletter, 2026-09-30 - Catch the scan before the encryption. On real lab telemetry, in Defender and Elastic.
- [Hunt Ransomware Before It Encrypts: The Three Tools 45+ Gangs Reach For](https://newsletter.securityinbits.com/p/hunt-ransomware-before-it-encrypts): newsletter, 2026-06-06 - As of May 2026, 3,734 organizations have been hit by ransomware.

## Deobfuscation
- [All Deobfuscation posts](https://www.securityinbits.com/category/malware-analysis/deobfuscation/): 4 posts
- [Deobfuscate PowerShell using MinusOne](https://www.securityinbits.com/malware-analysis/deobfuscation/deobfuscate-powershell-reverse-shell/): Learn how Reverse Shell Generator creates obfuscated PowerShell and how MinusOne (by AirbusCERT) quickly deobfuscates it.
- [Deobfuscate PowerShell using PowerShell Logging](https://www.securityinbits.com/malware-analysis/deobfuscate-powershell-using-powershell-logging/): Analyze/Deobfuscate malicious PowerShell faster by enabling PowerShell Enhanced logging. Example scenario Using Emotet & Qbot
- [Deobfuscate Emotet PowerShell – Part 0x2](https://www.securityinbits.com/malware-analysis/deobfuscate-emotet-powershell/): Deobfuscate and extract CC from the PowerShell cmd extracted from the Emotet downloader.
- [Deobfuscate malicious macro – Part 0x1](https://www.securityinbits.com/malware-analysis/deobfuscate-malicious-macro/): We will concentrate on malicious macro embedded in Emotet downloader office document and see how to deobfuscate the macro code.

## Tools
- [All Tools posts](https://www.securityinbits.com/category/tools/): 4 posts
- [Deobfuscate PowerShell using subtract – CyberChef Recipe 0x4](https://www.securityinbits.com/tools/cyberchef/deobfuscate-powershell-using-subtract-cyberchef-recipe-0x4/): We’ll explore CyberChef operations e.g Generic code Beautify, Subsection, Fork, Subtract etc. to deobfuscate the 2nd stage PowerShell script used in the RedLine stealer infection chain.
- [Deobfuscate Script using CyberChef – Recipe 0x3](https://www.securityinbits.com/tools/cyberchef/deobfuscate-script-using-cyberchef-recipe-3/): Explore Deobfuscation with CyberChef as we decode VBScript used in the RedLine stealer infection chain. We’ll explore the various CyberChef operations e.g Subsection, From Base, Fork etc.
- [AsyncRAT config decryption using CyberChef – Recipe 0x2](https://www.securityinbits.com/tools/cyberchef/asyncrat-config-decryption-using-cyberchef-recipe-2/): Decrypt AsyncRAT configurations effortlessly using CyberChef with our step-by-step guide. Dive into the recipe and enhance your malware analysis skills.
- [Important Wireshark filters](https://www.securityinbits.com/tools/wireshark-filters/): We will look into some of the Wireshark display filters which can be used in malware analysis.

## CyberChef
- [All CyberChef posts](https://www.securityinbits.com/category/tools/cyberchef/): 4 posts
- [Deobfuscate PowerShell using subtract – CyberChef Recipe 0x4](https://www.securityinbits.com/tools/cyberchef/deobfuscate-powershell-using-subtract-cyberchef-recipe-0x4/): We’ll explore CyberChef operations e.g Generic code Beautify, Subsection, Fork, Subtract etc. to deobfuscate the 2nd stage PowerShell script used in the RedLine stealer infection chain.
- [Deobfuscate Script using CyberChef – Recipe 0x3](https://www.securityinbits.com/tools/cyberchef/deobfuscate-script-using-cyberchef-recipe-3/): Explore Deobfuscation with CyberChef as we decode VBScript used in the RedLine stealer infection chain. We’ll explore the various CyberChef operations e.g Subsection, From Base, Fork etc.
- [AsyncRAT config decryption using CyberChef – Recipe 0x2](https://www.securityinbits.com/tools/cyberchef/asyncrat-config-decryption-using-cyberchef-recipe-2/): Decrypt AsyncRAT configurations effortlessly using CyberChef with our step-by-step guide. Dive into the recipe and enhance your malware analysis skills.
- [Converting Integers to Hex with CyberChef – Recipe 0x1](https://www.securityinbits.com/tools/cyberchef/converting-integers-to-hex-with-cyberchef-recipe-1/): We will use CyberChef to decode the integer array into hex and pad it with extra 0s if needed. Then, we can disassemble the code using an online tool or CyberChef.

## Unpacking
- [All Unpacking posts](https://www.securityinbits.com/category/malware-analysis/unpacking/): 3 posts
- [Unpack RedLine stealer using dnSpyEx – Part 3](https://www.securityinbits.com/malware-analysis/unpack-redline-stealer-using-dnspyex-part-3/): Dive into unpacking and extracting config from RedLine Stealer using dnSpyEx. This is the 3rd part in our RedLine malware series.
- [Unpack RedLine stealer to extract config using pe-sieve -Part 2](https://www.securityinbits.com/malware-analysis/unpack-redline-stealer-to-extract-config-using-pe-sieve-part-2/): Unpack RedLine stealer to extract config using pe-sieve. pe-sieve dumps then unpacked files from memory. Then, extract the config from the dumped file.
- [Unpacking Pyrogenic/Qealler using Java agent -Part 0x2](https://www.securityinbits.com/malware-analysis/unpacking/unpacking-pyrogenic-qealler-using-java-agent-part-0x2/): We will learn how and when we can use Java agent to quickly unpack the Pyrogenic/Qealler Infostealer.

## Command and Control
- [All Command and Control posts](https://www.securityinbits.com/category/command-and-control/): 0 posts and 3 newsletter issues
- [ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays](https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud): newsletter, 2026-09-23 - Two real samples in my lab dropped two implants on one host. One vendor-signed and loud, one self-hosted and configured to be invisible. Here is how to hunt both.
- [32 Ransomware Groups Abuse AnyDesk. Your EDR Sees a Legit Tool](https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk): newsletter, 2026-07-29 - Is That AnyDesk Legit or Planted? A Lab-Validated Hunt
- [Detecting Reverse SSH SOCKS Tunnels: Separating Benign -R From Akira Pivoting](https://newsletter.securityinbits.com/p/detecting-reverse-ssh-socks-tunnels): newsletter, 2026-06-17 - Two of these three ssh.exe -R sessions are benign. The telemetry that separates them, and the one case it can't.

## CheatSheet
- [All CheatSheet posts](https://www.securityinbits.com/category/cheatsheet/): 2 posts
- [Linux Cheat Sheet](https://www.securityinbits.com/cheatsheet/linux-cheat-sheet/): Explore essential Linux commands in this regularly updated cheat sheet, tested on Debian-based systems like Ubuntu. Bookmark for future reference!
- [Vim Cheat Sheet](https://www.securityinbits.com/cheatsheet/vim-cheat-sheet/): Mastering Vim has been both challenging and rewarding. In this evolving cheat sheet, I share frequently used shortcuts seamlessly integrated into my VSCode and Obsidian workflow.

## Credential Access
- [All Credential Access posts](https://www.securityinbits.com/category/credential-access/): 2 posts
- [wbadmin NTDS.dit dump detection for Domain Controllers](https://www.securityinbits.com/detection-engineering/wbadmin-ntds-dit-dump-detection/): wbadmin NTDS.dit dump detection for DCs using Sigma, MDE KQL, and Elastic plus fast triage with Backup logs.
- [LSASS Dump via comsvcs.dll: Defender Detection Guide](https://www.securityinbits.com/detection-engineering/lsass-dump-comsvcs-rundll32/): Detect LSASS dump with comsvcs.dll and rundll32. Clear command breakdown and Sigma mappings for Defender and Elastic

## Static analysis
- [All Static analysis posts](https://www.securityinbits.com/category/malware-analysis/static-analysis/): 2 posts
- [Qealler Infostealer static analysis – Part 0x1](https://www.securityinbits.com/malware-analysis/pyrogenic-infostealer-static-analysis-part-0x1/): Pyrogenic/Qealler is heavily obfuscated Java based Infostealer which is quiet active based on ANY.RUN and this post will focus on Pyrogenic Infostealer static analysis
- [Extract strings](https://www.securityinbits.com/malware-analysis/extract-strings/): Extracting strings is important step in malware anlaysis. We will learn how we can extract/interpret strings from malware.

## RMM
- [All RMM posts](https://www.securityinbits.com/category/rmm/): 0 posts and 2 newsletter issues
- [ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays](https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud): newsletter, 2026-09-23 - Two real samples in my lab dropped two implants on one host. One vendor-signed and loud, one self-hosted and configured to be invisible. Here is how to hunt both.
- [32 Ransomware Groups Abuse AnyDesk. Your EDR Sees a Legit Tool](https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk): newsletter, 2026-07-29 - Is That AnyDesk Legit or Planted? A Lab-Validated Hunt

## Persistence
- [All Persistence posts](https://www.securityinbits.com/category/persistence/): 0 posts and 2 newsletter issues
- [ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays](https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud): newsletter, 2026-09-23 - Two real samples in my lab dropped two implants on one host. One vendor-signed and loud, one self-hosted and configured to be invisible. Here is how to hunt both.
- [32 Ransomware Groups Abuse AnyDesk. Your EDR Sees a Legit Tool](https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk): newsletter, 2026-07-29 - Is That AnyDesk Legit or Planted? A Lab-Validated Hunt

## Defense Evasion
- [All Defense Evasion posts](https://www.securityinbits.com/category/defense-evasion/): 1 post
- [LSASS Dump via comsvcs.dll: Defender Detection Guide](https://www.securityinbits.com/detection-engineering/lsass-dump-comsvcs-rundll32/): Detect LSASS dump with comsvcs.dll and rundll32. Clear command breakdown and Sigma mappings for Defender and Elastic

## Incident Response
- [All Incident Response posts](https://www.securityinbits.com/category/incident-response/): 1 post
- [PowerShell Commands for Incident Response](https://www.securityinbits.com/incident-response/powershell-commands-for-incident-response/): We will learn different PowerShell Commands can be used in Incident Response to remediate the machine. I will take a scenario where a machine is infected with NanoCore malware to explain this PowerShell Commands.

## Threat Intelligence
- [All Threat Intelligence posts](https://www.securityinbits.com/category/threat-intelligence/): 1 post
- [AdaptixC2 Defender](https://www.securityinbits.com/threat-intelligence/adaptixc2-defender-guide/): Practical AdaptixC2 defender guide with real incidents, quick detection tips, default user agent, YARA, and a config extractor.

## ATT&CK techniques
- [T1003.001 LSASS Memory](https://www.securityinbits.com/tag/t1003-001/): https://attack.mitre.org/techniques/T1003/001
- [T1003.003 NTDS](https://www.securityinbits.com/tag/t1003-003/): https://attack.mitre.org/techniques/T1003/003
- [T1016 System Network Configuration Discovery](https://www.securityinbits.com/tag/t1016/): https://attack.mitre.org/techniques/T1016
- [T1018 Remote System Discovery](https://www.securityinbits.com/tag/t1018/): https://attack.mitre.org/techniques/T1018
- [T1027.010 Command Obfuscation](https://www.securityinbits.com/tag/t1027-010/): https://attack.mitre.org/techniques/T1027/010
- [T1033 System Owner/User Discovery](https://www.securityinbits.com/tag/t1033/): https://attack.mitre.org/techniques/T1033
- [T1036 Masquerading](https://www.securityinbits.com/tag/t1036/): https://attack.mitre.org/techniques/T1036
- [T1046 Network Service Discovery](https://www.securityinbits.com/tag/t1046/): https://attack.mitre.org/techniques/T1046
- [T1057 Process Discovery](https://www.securityinbits.com/tag/t1057/): https://attack.mitre.org/techniques/T1057
- [T1059.001 PowerShell](https://www.securityinbits.com/tag/t1059-001/): https://attack.mitre.org/techniques/T1059/001
- [T1087.001 Local Account](https://www.securityinbits.com/tag/t1087-001/): https://attack.mitre.org/techniques/T1087/001
- [T1087.002 Domain Account](https://www.securityinbits.com/tag/t1087-002/): https://attack.mitre.org/techniques/T1087/002
- [T1090.002 External Proxy](https://www.securityinbits.com/tag/t1090-002/): https://attack.mitre.org/techniques/T1090/002
- [T1218 System Binary Proxy Execution](https://www.securityinbits.com/tag/t1218/): https://attack.mitre.org/techniques/T1218
- [T1218.003 CMSTP](https://www.securityinbits.com/tag/t1218-003/): https://attack.mitre.org/techniques/T1218/003
- [T1218.005 Mshta](https://www.securityinbits.com/tag/t1218-005/): https://attack.mitre.org/techniques/T1218/005
- [T1219 Remote Access Tools](https://www.securityinbits.com/tag/t1219/): https://attack.mitre.org/techniques/T1219
- [T1482 Domain Trust Discovery](https://www.securityinbits.com/tag/t1482/): https://attack.mitre.org/techniques/T1482
- [T1543.003 Windows Service](https://www.securityinbits.com/tag/t1543-003/): https://attack.mitre.org/techniques/T1543/003
- [T1548.002 Bypass User Account Control](https://www.securityinbits.com/tag/t1548-002/): https://attack.mitre.org/techniques/T1548/002
- [T1555.003 Credentials from Web Browsers](https://www.securityinbits.com/tag/t1555-003/): https://attack.mitre.org/techniques/T1555/003
- [T1572 Protocol Tunneling](https://www.securityinbits.com/tag/t1572/): https://attack.mitre.org/techniques/T1572

## Newsletter
- [Security-in-bits newsletter](https://newsletter.securityinbits.com/): new detection work ships here first, free
- [Load Real Defender Telemetry into a Free ADX Cluster in One Paste](https://newsletter.securityinbits.com/p/load-real-defender-telemetry-into): 2026-10-28 - No tenant, no Azure subscription, no credit card. Eight MDE tables from a real lab intrusion, loaded with one script, checked against known row counts.
- [Watch it run: the network scan 45+ ransomware groups use](https://newsletter.securityinbits.com/p/watch-it-run-the-network-scan-45): 2026-09-30 - Catch the scan before the encryption. On real lab telemetry, in Defender and Elastic.
- [ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays](https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud): 2026-09-23 - Two real samples in my lab dropped two implants on one host. One vendor-signed and loud, one self-hosted and configured to be invisible. Here is how to hunt both.
- [32 Ransomware Groups Abuse AnyDesk. Your EDR Sees a Legit Tool](https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk): 2026-07-29 - Is That AnyDesk Legit or Planted? A Lab-Validated Hunt
- [Detecting Reverse SSH SOCKS Tunnels: Separating Benign -R From Akira Pivoting](https://newsletter.securityinbits.com/p/detecting-reverse-ssh-socks-tunnels): 2026-06-17 - Two of these three ssh.exe -R sessions are benign. The telemetry that separates them, and the one case it can't.
- [Hunt Ransomware Before It Encrypts: The Three Tools 45+ Gangs Reach For](https://newsletter.securityinbits.com/p/hunt-ransomware-before-it-encrypts): 2026-06-06 - As of May 2026, 3,734 organizations have been hit by ransomware.

## Optional
- [Subscribe](https://newsletter.securityinbits.com/subscribe?utm_source=website&utm_medium=llms): the signup page on Substack
- [X / Twitter](https://x.com/Securityinbits): short-form lab notes
- [RSS feed](https://www.securityinbits.com/rss.xml)