Field notes
Notes from building detection for adversaries who use nothing but legitimate tools — written by the people building it, for the people who have to work the queue.
Every tool worked exactly as designed. The campaign still ran for four months. The problem is not detection quality — it is that nothing in the stack was built to assemble a story across machines.
Ben Lindquist
3 min read
Endpoint platforms are authoritative about what happened on a machine, and they are being asked a question they were never designed…
Aurelien Schlumberger
3 min read
Printers, controllers, imaging systems and legacy appliances carry real traffic and take no security software. In most environments…
Aurelien Schlumberger
2 min read
See it work
The fastest way to understand any of this is to see the console reconstruct a four-hop path on sanitised data.