Subscribe - Securityinbits

🔒 Security-in-bits Newsletter

Join for free. Practical security bits you can act on the same day. No theory, no fluff.

No spam. Unsubscribe anytime.

Start here (popular deep dives)

wbadmin NTDS.dit dump detection for Domain Controllers

January 3, 2026

elasticsearch, ntds, sigma rules, t1003-003, wbadmin

When wbadmin.exe is used to back up NTDS.dit + registry hives, treat it as credential access, not routine IT backup. This post is for Elastic + Sigma + Windows logs and focuses on wbadmin NTDS.dit dump detection you can validate…

LSASS Dump via comsvcs.dll: Defender Detection Guide

September 25, 2025

elasticsearch, kql, lsass, sigma rules, t1003-001, t1027-010, t1036, t1057

Attackers dump LSASS with comsvcs.dll to steal credentials; here’s how to spot rundll32 + MiniDump fast and reliably. 🙂 What the technique is Adversaries attempt to access credential stored in the process memory of the Local Security Authority Subsystem Service…

Deobfuscate PowerShell using MinusOne

September 22, 2025

minusone, PowerShell, reverse-shell

Obfuscated PowerShell is everywhere – this post shows how the Reverse Shell Generator produces randomized scripts and how MinusOne deobfuscates them in seconds. It generates a different PowerShell variant every time you click Generate. Obfuscated PowerShell Obfuscated Revshell Powershell Deobfuscated…

Unpack RedLine stealer using dnSpyEx – Part 3

February 12, 2024

.NET, Config, Debugging, dnSpyEx, Infostealer, Malware Series, RedLine

In this article, we dive into process of unpacking and extracting config from RedLine Stealer using dnSpyEx. It’s a bit lengthy but a great way to learn about the unpacking process using dnSpyEx. 🔍 This is the 3rd part in…