{ "version": 1, "reviewed_at": "2026-10-27", "site_commit": "13b8a784838801e25fe98a54e98a47817fe9b2a7", "archive_repository": "anpa1200/medium-blog-navigation", "archive_commit": "0e086667d49ecd1c820236b710eaa616f647bd20", "scope": "All 194 authored archive articles at the pinned publication commit, standalone guide/lab/research/case-study catalogue identities, and 87 attributed TrainSec public readings. Generated ATT&CK/ITDR reference pages and product documentation are not authored articles.", "stages": [ { "slug": "reconnaissance", "name": "Reconnaissance", "strapline": "Understand the target", "description": "Target selection, public exposure, asset discovery, and the intelligence that makes an intrusion possible.", "defense": "Review exposed services and public information; distinguish external reconnaissance from discovery after access.", "techniques": [ "T1595", "T1593" ], "explanation": { "overview": "Reconnaissance is the preparation in which an adversary learns enough about a target to choose an approach. The information may come from public sources, interactions with exposed services, or earlier knowledge of the organization. The goal is to reduce uncertainty about who to target, which systems are reachable, and where a useful weakness might exist.", "activities": [ "Identify public domains, internet-facing systems, technologies, and organizational relationships.", "Research people, roles, suppliers, and public information that could support targeting or a convincing pretext.", "Assess exposed services and potential weaknesses before choosing an entry route." ], "example": "A public job advertisement reveals a technology in use, while an exposed service confirms that it is reachable. Together, those observations can guide a later attempt; neither observation establishes that an intrusion occurred.", "boundary": "Passive research may leave no trace in the target’s own logs. Active scanning can produce network or application events, but legitimate monitoring can look similar. Discovery inside an already compromised environment serves a different purpose from pre-intrusion reconnaissance.", "question": "What can an outsider learn about us, and which changes in exposure or scanning deserve investigation?" } }, { "slug": "weaponization", "name": "Weaponization", "strapline": "Prepare the capability", "description": "Payloads, exploits, malicious documents, and compromised build artifacts prepared for an operation.", "defense": "Study payload structure and provenance. Static capability clues support hypotheses; they do not prove execution.", "techniques": [ "T1587", "T1588" ], "explanation": { "overview": "Weaponization is the preparation or adaptation of a capability for use against the target. In the classic model, this often means combining an exploit with a payload and packaging it into a deliverable artifact. The capability may be developed, purchased, reused, or modified; it does not have to be novel.", "activities": [ "Select or adapt an exploit and the payload intended to run after access.", "Prepare a malicious document, executable, script, or modified software artifact for a chosen delivery route.", "Configure payload behavior and use packaging or obfuscation to make the artifact usable in the intended environment." ], "example": "An attacker prepares a document containing malicious content before sending it. Preparing that artifact is weaponization; sending it is delivery; triggering its behavior belongs to the later execution or exploitation analysis.", "boundary": "Much of this work happens outside the defender’s environment. Recovered samples, build artifacts, and intelligence can reveal preparation, but imports, strings, and file structure indicate possible capabilities rather than proof that they ran.", "question": "What was the artifact prepared to do, and which independent evidence would confirm those capabilities?" } }, { "slug": "delivery", "name": "Delivery", "strapline": "Reach the target", "description": "Email, web content, removable media, software updates, and other routes that bring an adversary-controlled artifact to a target.", "defense": "Correlate email, browser, download, and endpoint evidence to establish how an artifact arrived.", "techniques": [ "T1566", "T1189" ], "explanation": { "overview": "Delivery is the point at which an adversary brings a malicious artifact or interaction to the target. It connects preparation to the environment the adversary wants to affect. The route can involve a message, a website, removable media, a trusted supplier, or a software distribution channel.", "activities": [ "Send a malicious attachment or link through email or another communication channel.", "Place adversary-controlled content where a target is expected to browse, download, or retrieve it.", "Use removable media or a compromised software distribution path to bring an artifact into the environment." ], "example": "An employee receives an email with an attachment. Mail and download records can establish arrival, but receiving or saving the attachment does not establish that its payload executed.", "boundary": "Delivery and exploitation can be close together, as with browser-based attacks, but they answer different questions: how did it reach the target, and what caused unauthorized behavior? Some identity or insider incidents do not involve a conventional delivered malware file.", "question": "Which route brought the artifact or interaction to the target, and can we connect that arrival to subsequent activity?" } }, { "slug": "exploitation", "name": "Exploitation", "strapline": "Trigger unauthorized behavior", "description": "Vulnerability exploitation, user execution, and trust or credential abuse that turn exposure into access.", "defense": "Connect the triggering request or action to execution and identity evidence. Credential abuse is not automatically a software exploit.", "techniques": [ "T1203", "T1190" ], "explanation": { "overview": "Exploitation is the triggering of behavior that gives the adversary an opportunity to run code or cross a security boundary. A software vulnerability is a common mechanism. In the broader intrusion story, user actions and failures of trust can also help turn delivered content into unauthorized execution.", "activities": [ "Trigger a flaw in an exposed application, client, document parser, or operating-system component.", "Cause a user or application to execute adversary-controlled content.", "Use the resulting execution or access to establish an initial foothold." ], "example": "A crafted request reaches a vulnerable application and is followed by an unexpected child process. The request and process relationship are stronger evidence of exploitation than the presence of an unpatched version alone.", "boundary": "A vulnerability scan identifies a possible weakness; it does not prove successful exploitation. Credential guessing, stolen-account use, and permission abuse can provide access without exploiting a software flaw. Relevant guides include these adjacent access paths with that distinction preserved.", "question": "Which request, input, or user action crossed the boundary, and what evidence shows that it succeeded?" } }, { "slug": "installation", "name": "Installation", "strapline": "Establish a foothold", "description": "Deployment of implants, backdoors, malicious components, or mechanisms that maintain access.", "defense": "Examine file, process, service, task, and configuration changes. Persistence can support installation, but the two are not synonyms.", "techniques": [ "T1547", "T1543" ], "explanation": { "overview": "Installation is the establishment of an adversary-controlled component in the compromised environment. An implant, backdoor, malicious extension, or web shell can give the operator a foothold from which to continue. The relevant evidence is the component and the changes that made it available for use.", "activities": [ "Place or load a malicious executable, script, web shell, or other component.", "Change a service, scheduled task, startup entry, or application configuration to support continued access.", "Prepare the foothold to survive expected interruptions when the operation requires persistence." ], "example": "After an application compromise, a new web shell appears in a server directory. File-change records, application requests, and process events can help establish when it was placed and whether it was used.", "boundary": "Installation and persistence overlap, but are not identical. A newly deployed component may be temporary, and persistence can rely on identity or configuration changes rather than a conventional installed program. Memory-only activity may leave little durable file evidence.", "question": "What new component or configuration established the foothold, and which evidence distinguishes it from an authorized change?" } }, { "slug": "command-and-control", "name": "Command and Control", "strapline": "Coordinate the operation", "description": "Channels through which an operator or infrastructure communicates with compromised systems.", "defense": "Combine DNS, HTTP/TLS, flow metadata, and endpoint context. A suspicious connection alone does not establish C2.", "techniques": [ "T1071", "T1573" ], "explanation": { "overview": "Command and Control, often shortened to C2, is the communication that lets an adversary direct or coordinate activity on compromised systems. The channel may deliver instructions, return results, or obtain additional components. It can use familiar protocols and legitimate services, so the protocol name alone does not establish malicious intent.", "activities": [ "Establish communication between a compromised system and operator-controlled or abused infrastructure.", "Exchange instructions, execution results, status messages, or additional payloads.", "Use direct connections, intermediaries, or changing infrastructure to maintain communication as the operation evolves." ], "example": "A process repeatedly contacts an unfamiliar destination and receives responses before launching commands. Timing, destination history, process identity, and the resulting actions together support a C2 hypothesis.", "boundary": "A domain in a binary, periodic traffic, encryption, or use of port 443 is not sufficient proof of C2. Some payloads operate autonomously after staging and do not need a continuing command channel. Data transferred over C2 may also serve an objective such as exfiltration.", "question": "Who is communicating, what changes after the communication, and what corroborates operator control?" } }, { "slug": "actions-on-objectives", "name": "Actions on Objectives", "strapline": "Pursue the intended outcome", "description": "Theft, espionage, disruption, destruction, encryption, fraud, and other mission outcomes.", "defense": "Relate collection, movement, and impact evidence to the objective; distinguish demonstrated harm from plausible capability.", "techniques": [ "T1041", "T1486" ], "explanation": { "overview": "Actions on Objectives are the activities through which the adversary pursues the intended outcome of the operation. That outcome may be intelligence collection, theft, financial gain, disruption, destruction, or manipulation. This stage explains why the intrusion matters to the affected organization.", "activities": [ "Collect and access information of value, then transfer it when theft is the objective.", "Encrypt, delete, alter, or disrupt systems and data when the goal involves impact.", "Use compromised access to support fraud, espionage, or another mission-specific outcome." ], "example": "An account accesses an unusual volume of sensitive files and transfers data to an external destination. Access logs, transfer evidence, and the business role of those files help distinguish collection from demonstrated theft.", "boundary": "Objectives are not limited to exfiltration or ransomware. Internal discovery, credential access, and lateral movement may be enabling steps toward an objective rather than the final outcome themselves. A capability to destroy or steal data does not establish that destruction or theft occurred.", "question": "What outcome was pursued, what was actually achieved, and which evidence supports the resulting business impact?" } } ], "items": [ { "id": "archive:2024/2024-10-17-wifi-cracking-with-aircrack-ng-d51cf98c789f", "title": "WiFi cracking with Aircrack-ng", "url": "https://1200km.com/articles/read/2024/2024-10-17-wifi-cracking-with-aircrack-ng-d51cf98c789f/", "kind": "authored", "source_path": "2024/2024-10-17-wifi-cracking-with-aircrack-ng-d51cf98c789f.md", "source_sha256": "94ecb24b8a9576cc568039ede182aff62d86ee72f79fcda2ac6f034710bf7ac7", "evidence_sections": [ "In this article, I am going to explain how you can crack a WiFi network using Aircrack-ng and the PPG — Personal Pass Generator tools.", "How to install Aircrack-ng", "Listen to the Target Network:" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "archive:2024/2024-10-20-accessing-remote-desktops-a-beginner-s-guide-to-rdp-cracking-with-crowbar-and-ppg-tools-5f50027115b7", "title": "Accessing Remote Desktops: A Beginner’s Guide to RDP Cracking with Crowbar and PPG tools", "url": "https://1200km.com/articles/read/2024/2024-10-20-accessing-remote-desktops-a-beginner-s-guide-to-rdp-cracking-with-crowbar-and-ppg-tools-5f50027115b7/", "kind": "authored", "source_path": "2024/2024-10-20-accessing-remote-desktops-a-beginner-s-guide-to-rdp-cracking-with-crowbar-and-ppg-tools-5f50027115b7.md", "source_sha256": "524540819d6a6a2d4d391c4ed8c9266f32d8234bb23c0adad61d2b58d5f6f847", "evidence_sections": [ "Installation", "Network Level Authentication (NLA)" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Monitor and Audit RDP Access" ] } ] }, { "id": "archive:2024/2024-10-20-personal-pass-generator-ppg-the-ultimate-tool-for-custom-password-lists-4979a3a1385c", "title": "Personal Pass Generator (PPG): The Ultimate Tool for Custom Password Lists", "url": "https://1200km.com/articles/read/2024/2024-10-20-personal-pass-generator-ppg-the-ultimate-tool-for-custom-password-lists-4979a3a1385c/", "kind": "authored", "source_path": "2024/2024-10-20-personal-pass-generator-ppg-the-ultimate-tool-for-custom-password-lists-4979a3a1385c.md", "source_sha256": "be3715cd5ba6db47c0a15d96fd2215f5207a36226f493a7b655149c18f71c007", "evidence_sections": [ "Personal Pass Generator (PPG) . This advanced tool is designed for penetration testers, ethical hackers, and cybersecurity researchers who need custom wordlists for their brute-force and dictionary-based password attacks.", "What is a Brute-Force Attack?", "How Does Brute-Force Work?", "Title: Introducing the Personal Pass Generator (PPG): The Ultimate Tool for Custom Password Lists", "What is a Brute-Force Attack?" ], "placements": [ { "stage": "weaponization", "note": "Preparation of target-specific password dictionaries; this supports credential-testing capability, not malware weaponization.", "read_sections": [] } ] }, { "id": "archive:2024/2024-10-21-exploiting-ftp-vulnerabilities-for-effective-penetration-testing-a2810df78602", "title": "Exploiting FTP Vulnerabilities for Effective Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-10-21-exploiting-ftp-vulnerabilities-for-effective-penetration-testing-a2810df78602/", "kind": "authored", "source_path": "2024/2024-10-21-exploiting-ftp-vulnerabilities-for-effective-penetration-testing-a2810df78602.md", "source_sha256": "2104dbfe1e682d5ce8d95bf243f5af06fd29a6fd1bdb70964ee764a0fae2de91", "evidence_sections": [ "In this guide, we will explore common vulnerabilities in the File Transfer Protocol (FTP) and demonstrate how attackers can exploit them to gain unauthorized access to networks and systems.", "2. Test for Common Vulnerabilities:", "What the Command Does:", "3. Misconfigurations and Default Credentials", "4. Try to upload harmful files to writable directories and evaluate the potential impact.", "5. Check for directory traversal vulnerabilities to bypass directory restrictions.", "6. Search for Known Exploits:" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "2. Test for Common Vulnerabilities", "3. Misconfigurations and Default Credentials" ] } ] }, { "id": "archive:2024/2024-10-22-cracking-telnet-exploring-weaknesses-and-exploitation-techniques-af5d743abb09", "title": "Cracking Telnet: Exploring Weaknesses and Exploitation Techniques", "url": "https://1200km.com/articles/read/2024/2024-10-22-cracking-telnet-exploring-weaknesses-and-exploitation-techniques-af5d743abb09/", "kind": "authored", "source_path": "2024/2024-10-22-cracking-telnet-exploring-weaknesses-and-exploitation-techniques-af5d743abb09.md", "source_sha256": "e557ace32e2081e06a6b344ca3774892e31908d7c0acf69c29fe97b649c2ee3f", "evidence_sections": [ "In this article, I will walk you through the process of cracking a Telnet service, exploring weaknesses, and leveraging tools for successful exploitation. We’ll dive into methods like brute force attacks and show how to identify and exploit Telnet vulnerabilities.", "Common Vulnerabilities in Telnet", "1. Weak or Default Credentials", "3. Outdated Software and Vulnerabilities", "Brute Forcing Telnet Credentials", "Hydra Command Example:", "Hydra Command Breakdown:", "Exploiting Telnet Vulnerabilities", "1. Remote System Control", "2. Post-Exploitation Actions" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Common Vulnerabilities in Telnet", "1. Weak or Default Credentials" ] } ] }, { "id": "archive:2024/2024-10-23-cracking-rtsp-security-a-comprehensive-guide-to-using-the-rtsp-brute-force-tool-ad1c29b9e5ee", "title": "Cracking RTSP Security: A Comprehensive Guide to Using the RTSP Brute Force Tool", "url": "https://1200km.com/articles/read/2024/2024-10-23-cracking-rtsp-security-a-comprehensive-guide-to-using-the-rtsp-brute-force-tool-ad1c29b9e5ee/", "kind": "authored", "source_path": "2024/2024-10-23-cracking-rtsp-security-a-comprehensive-guide-to-using-the-rtsp-brute-force-tool-ad1c29b9e5ee.md", "source_sha256": "989f89f1e9d8abdf0a6d2bb097f5c5e798ed479d88af315320f48bd6cb819ddf", "evidence_sections": [ "Understanding RTSP and Its Vulnerabilities", "And if you want to connect to camera and you don’t know a valid credentials?" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Understanding RTSP and Its Vulnerabilities", "And if you want to connect to camera and you don’t know a valid credentials?" ] } ] }, { "id": "archive:2024/2024-10-23-cracking-ssh-with-metasploit-a-step-by-step-guide-to-exploiting-weak-credentials-3ec6ef4cee5b", "title": "Cracking SSH with Metasploit: A Step-by-Step Guide to Exploiting Weak Credentials", "url": "https://1200km.com/articles/read/2024/2024-10-23-cracking-ssh-with-metasploit-a-step-by-step-guide-to-exploiting-weak-credentials-3ec6ef4cee5b/", "kind": "authored", "source_path": "2024/2024-10-23-cracking-ssh-with-metasploit-a-step-by-step-guide-to-exploiting-weak-credentials-3ec6ef4cee5b.md", "source_sha256": "bdae4fa5b7c0ae2858badcfbc4d07836ca2351902a01fc3fd3d0f796247ccfef", "evidence_sections": [ "In this article, I will walk you through the process of cracking SSH using Metasploit , exploring common vulnerabilities, and utilizing tools for successful exploitation. We’ll dive into methods like brute force attacks and show how to identify and exploit SSH weaknesses.", "Common Vulnerabilities in SSH", "1. Weak or Default Credentials", "Exploiting SSH Vulnerabilities", "Post-Exploitation Actions:" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Common Vulnerabilities in SSH", "1. Weak or Default Credentials" ] } ] }, { "id": "archive:2024/2024-10-24-cracking-web-interfaces-with-burp-suite-a-comprehensive-tutorial-33087bb286b0", "title": "Cracking Web Interfaces with Burp Suite: A Comprehensive Tutorial", "url": "https://1200km.com/articles/read/2024/2024-10-24-cracking-web-interfaces-with-burp-suite-a-comprehensive-tutorial-33087bb286b0/", "kind": "authored", "source_path": "2024/2024-10-24-cracking-web-interfaces-with-burp-suite-a-comprehensive-tutorial-33087bb286b0.md", "source_sha256": "32a939f3bb31f0f8ea34b837868ed6f95af8ab60e2fc23b61d4a36a9bf2e4f5b", "evidence_sections": [ "In this guide, I will detail how to use Burp Suite, a popular web security tool, to perform password cracking attacks on web interfaces. Web interfaces are common targets for cyber attacks due to their accessibility and potential security lapses.", "Disclaimer", "What is Burp Suite?", "Using Burp Suite to Crack Passwords on Web Interfaces", "Step 7: Analyze the Results" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "archive:2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe", "title": "Shodan , guide how you can find everything!", "url": "https://1200km.com/articles/read/2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe/", "kind": "authored", "source_path": "2024/2024-10-24-shodan-guide-how-you-can-find-everything-640f47f41bbe.md", "source_sha256": "d671c565f04b419bf25d681ae0935ec8795d10c1ed6e5782d8160c46ff634771", "evidence_sections": [ "What devices can Shodan really find with examples and exploit:", "Vulnerable or Misconfigured FTP Servers:", "Vulnerable or Misconfigured RDP Services:", "Vulnerable or Misconfigured Telnet Services:", "Vulnerable or Misconfigured RTSP Services:", "Vulnerable and Accessible Cameras", "Industrial Control Systems", "Monitoring and Control Devices", "Network Infrastructure", "Network Devices and Tools", "Vulnerabilities and Misconfigurations", "Network File Sharing Vulnerabilities", "Specific FTP Configurations and Vulnerabilities", "Ransomware and Malware", "Bitcoin and Cryptocurrency Threats", "Dashboard and Control Panel Interfaces", "Configuration Vulnerabilities" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] } ] }, { "id": "archive:2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0", "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 1", "url": "https://1200km.com/articles/read/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0/", "kind": "authored", "source_path": "2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0.md", "source_sha256": "976cadf83624ba0c723c03475eb784b4d8f24883134fbfeb8bc0fe070ab81965", "evidence_sections": [ "This comprehensive post will delve into the powerful network scanning tool, Nmap, exploring its capabilities from basic to advanced levels. It includes practical tutorials on using Nmap’s various commands, the Nmap Scripting Engine, and integration with other security tools. The guide aims to equip readers with the skills to conduct thorough network explorations and security audits.", "Introduction to Nmap: Your Gateway to Mastering Network Security", "Installing Nmap on Various Operating Systems", "First command:", "I will use output of this command for article of this post:", "TARGET SPECIFICATION: Can pass hostnames, IP addresses, networks, etc.", "Hostname/domain name scanning:", "IP address scanning:", "Output of basic nmap scanning:", "Networks scanning:", "Input from list of hosts/networks", "Exclude addresses from scanning:", "Output of basic network or range scanning:" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Hostname/domain name scanning", "IP address scanning" ] } ] }, { "id": "archive:2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c", "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 2", "url": "https://1200km.com/articles/read/2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c/", "kind": "authored", "source_path": "2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c.md", "source_sha256": "51513cc49e2f90d50b0a3632c9f7aac3e2696ef7c885150873bd6fe195a1294d", "evidence_sections": [ "SCAN TECHNIQUES:", "-sS : TCP SYN Scan", "-sT : TCP Connect() Scan", "-sA : TCP ACK Scan", "-sW : TCP Window Scan", "-sM : TCP Maimon Scan", "-sU: UDP Scan", "-sN : TCP Null Scan", "-sF : TCP FIN Scan", "-sX : TCP Xmas Scan", "— scanflags <flags>:", "Command Example:", "-sI <zombie host[:probeport]>: Idle scan", "Command Example:", "-sY/sZ: SCTP INIT/COOKIE-ECHO scans", "-sY : SCTP INIT Scan", "Command Example :", "-sZ : SCTP COOKIE-ECHO Scan" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "SCAN TECHNIQUES", "-sS : TCP SYN Scan" ] } ] }, { "id": "archive:2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2", "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 3", "url": "https://1200km.com/articles/read/2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2/", "kind": "authored", "source_path": "2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2.md", "source_sha256": "2de93ed9c81f802a9121a97bcf8d3c022ea4481c04ef25d56a6a0ed5046edc1b", "evidence_sections": [ "This a third part of comprehensive Medium post will delve into the powerful network scanning tool, Nmap, exploring its capabilities from basic to advanced levels. It includes practical tutorials on using Nmap’s various commands, the Nmap Scripting Engine, and integration with other security tools. The guide aims to equip readers with the skills to conduct thorough network explorations and security audits.", "PORT SPECIFICATION AND SCAN ORDER:", "-p <port ranges> : Specify Ports to Scan", "-exclude-ports <port ranges> : Exclude Specific Ports from Scanning", "-F : Fast Mode - Scan Fewer Ports", "-r : Sequential Port Scanning", "-top-ports <number> : Scan Top Common Ports", "-port-ratio <ratio> : Scan Ports Based on Popularity Ratio", "SERVICE/VERSION DETECTION:", "-version-trace : Show Detailed Version Scan Activity", "OS DETECTION:", "-O: Enable OS Detection", "-osscan-limit: Limit OS Detection to Promising Targets", "-osscan-guess: Guess OS More Aggressively", "Tips for Effective OS Detection" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "PORT SPECIFICATION AND SCAN ORDER", "-p <port ranges> : Specify Ports to Scan" ] } ] }, { "id": "archive:2024/2024-10-28-office-file-doc-docx-ppt-password-cracking-guide-with-real-life-examples-f8e356144ca4", "title": "Office file (DOC, DOCX, PPT…) Password cracking. Guide with real life examples!", "url": "https://1200km.com/articles/read/2024/2024-10-28-office-file-doc-docx-ppt-password-cracking-guide-with-real-life-examples-f8e356144ca4/", "kind": "authored", "source_path": "2024/2024-10-28-office-file-doc-docx-ppt-password-cracking-guide-with-real-life-examples-f8e356144ca4.md", "source_sha256": "79ce85cd37fbe541bfca87f9592fd065397b4afd660ec5f1ccab80f3bd1d8796", "evidence_sections": [ "If you have error: office2john: command not found" ], "placements": [ { "stage": "actions-on-objectives", "note": "Authorized recovery of an Office document password is a learning analogue for access to protected information, not evidence of theft.", "read_sections": [ "Office file password cracking", "Done! Password was found — “123456”" ] } ] }, { "id": "archive:2024/2024-10-28-pdf-file-password-cracking-guide-with-real-life-examples-901ee411a6f4", "title": "PDF file Password cracking. Guide with real life examples!", "url": "https://1200km.com/articles/read/2024/2024-10-28-pdf-file-password-cracking-guide-with-real-life-examples-901ee411a6f4/", "kind": "authored", "source_path": "2024/2024-10-28-pdf-file-password-cracking-guide-with-real-life-examples-901ee411a6f4.md", "source_sha256": "1e9e14e0fa110e2bcf3106280e33466bdef00b845eb22c28b2e216e586c8645a", "evidence_sections": [ "If you have error: pdf2john: command not found", "Command Breakdown", "Command flow for password-protected PDF file simple brute force:" ], "placements": [ { "stage": "actions-on-objectives", "note": "Authorized PDF password recovery supports understanding protected-data access; it does not demonstrate exfiltration.", "read_sections": [ "PDF file password cracking", "Done! Password was found — “123456”" ] } ] }, { "id": "archive:2024/2024-10-28-zip-file-password-cracking-guide-with-real-life-examples-4e8705d51897", "title": "ZIP file Password cracking. Guide with real life examples!", "url": "https://1200km.com/articles/read/2024/2024-10-28-zip-file-password-cracking-guide-with-real-life-examples-4e8705d51897/", "kind": "authored", "source_path": "2024/2024-10-28-zip-file-password-cracking-guide-with-real-life-examples-4e8705d51897.md", "source_sha256": "08a1a846cacbf7f4be41da5bf210580220c279c727c37b4304a8c2f21807c34d", "evidence_sections": [ "Command flow for password-protected ZIP file simple brute force:", "Command flow for password-protected ZIP file simple brute force:" ], "placements": [ { "stage": "actions-on-objectives", "note": "Authorized ZIP password recovery illustrates access to protected archive contents; it is not a theft case study.", "read_sections": [ "Zip file password cracking", "Done! Password was found — “123456”" ] } ] }, { "id": "archive:2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd", "title": "Passwords cracking.ZIP, PDF, WEB, RDP, SSH, Cameras…", "url": "https://1200km.com/articles/read/2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd/", "kind": "authored", "source_path": "2024/2024-10-29-passwords-cracking-zip-pdf-web-rdp-ssh-cameras-c1bacbd592cd.md", "source_sha256": "b709a37c6b1592188724c5b6239a9a770f8cd9b7fd1db717137767539ffb716f", "evidence_sections": [ "2. Predicting Vulnerabilities" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "2. Predicting Vulnerabilities" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Passwords cracking. Full guide with real life examples! (Zip, PDF, WiFi, RDP, Cameras, Web interface)", "Overview of Password Security" ] } ] }, { "id": "archive:2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f", "title": "Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 4. Scripts", "url": "https://1200km.com/articles/read/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f/", "kind": "authored", "source_path": "2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f.md", "source_sha256": "cec1a9e442358109fb5f3c66bfbe2c20096774176e7478a354e998e13df98756", "evidence_sections": [ "This a fours part of comprehensive Medium post will delve into Exploring the Depths of Network Security with Nmap Scripts: A Detailed Guide on Enhancing Network Scanning and Security Audits through Advanced Scripting Techniques" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] } ] }, { "id": "archive:2024/2024-11-01-mastering-hydra-the-ultimate-guide-to-network-logon-cracking-182579dbaed1", "title": "Mastering Hydra: The Ultimate Guide to Network Logon Cracking", "url": "https://1200km.com/articles/read/2024/2024-11-01-mastering-hydra-the-ultimate-guide-to-network-logon-cracking-182579dbaed1/", "kind": "authored", "source_path": "2024/2024-11-01-mastering-hydra-the-ultimate-guide-to-network-logon-cracking-182579dbaed1.md", "source_sha256": "c71661dbf638d6656ebaebc5f300e32411005644d71fcde3e15c01bf818e9237", "evidence_sections": [ "Unlocking the Gates of Network Security: An In-Depth Exploration into Mastering Hydra for Advanced Logon Cracking, Penetration Testing, and Ensuring System Integrity in the Digital Age", "Installation and Setup of Hydra", "Installing Hydra on Various Operating Systems", "Testing the Installation:", "Command Syntax", "General Network Protocols :" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "archive:2024/2024-11-03-breaking-the-code-how-to-use-hashcat-for-effective-password-cracking-15f8da8facb8", "title": "Breaking the Code: How to Use Hashcat for Effective Password Cracking", "url": "https://1200km.com/articles/read/2024/2024-11-03-breaking-the-code-how-to-use-hashcat-for-effective-password-cracking-15f8da8facb8/", "kind": "authored", "source_path": "2024/2024-11-03-breaking-the-code-how-to-use-hashcat-for-effective-password-cracking-15f8da8facb8.md", "source_sha256": "9f4a3686d046f7af58e99b3c3c3d5cc8358d25acb738dd6518992abe7b5f7a9b", "evidence_sections": [ "Installation and Setup Guide for Hashcat", "Windows Installation:", "Linux Installation:", "macOS Installation:", "Basic Command Syntax for Hashcat" ], "placements": [ { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ] }, { "id": "archive:2024/2024-11-04-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83", "title": "SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 1. (basic, wizard)", "url": "https://1200km.com/articles/read/2024/2024-11-04-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83/", "kind": "authored", "source_path": "2024/2024-11-04-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83.md", "source_sha256": "d8951045446bc9f5168b3e1032d024bcfd2ff100b0f54c6012122f82aad3b67a", "evidence_sections": [ "Learn how SQLMap transforms the landscape of database security by automating the detection and exploitation of SQL injection vulnerabilities.", "Installation and Setup of SQLMap", "Download and Installation", "Questions while scanning:", "Manual command configuration and advance settings in part 2." ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Accessible DBMS" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ] }, { "id": "archive:2024/2024-11-05-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53", "title": "SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 2. (Advanced, custom setup)", "url": "https://1200km.com/articles/read/2024/2024-11-05-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53/", "kind": "authored", "source_path": "2024/2024-11-05-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53.md", "source_sha256": "d82b8c4dccb451315b718e43711c1c27ff5dadc203475a1bf94df4805e967a33", "evidence_sections": [ "Learn how SQLMap transforms the landscape of database security by automating the detection and exploitation of SQL injection vulnerabilities.", "Use Case 3: Automated Extraction of Sensitive Data Post-Exploitation with Specific HTTP Headers" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Use Case 1: Testing a Website with Delayed Responses for Time-Based SQL Injection", "Use Case 3: Automated Extraction of Sensitive Data Post-Exploitation with Specific HTTP Headers" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ] }, { "id": "archive:2024/2024-11-06-owasp-amass-project-guide-94bd55521f91", "title": "OWASP Amass Project guide", "url": "https://1200km.com/articles/read/2024/2024-11-06-owasp-amass-project-guide-94bd55521f91/", "kind": "authored", "source_path": "2024/2024-11-06-owasp-amass-project-guide-94bd55521f91.md", "source_sha256": "e51fe4cb0165758abba62cd857a07e8b6aeaeb188176b07e59fcbf395773cc2a", "evidence_sections": [ "In-depth Attack Surface Mapping and Asset Discovery.", "Key Features of OWASP Amass", "Usage in Penetration Testing", "Example Use Cases", "Usage examples:" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Run Amass under Passive or Active Configuration" ] } ] }, { "id": "archive:2024/2024-11-07-sublist3r-your-essential-tool-for-subdomain-enumeration-c1910121d712", "title": "Sublist3r. Your Essential Tool for Subdomain Enumeration", "url": "https://1200km.com/articles/read/2024/2024-11-07-sublist3r-your-essential-tool-for-subdomain-enumeration-c1910121d712/", "kind": "authored", "source_path": "2024/2024-11-07-sublist3r-your-essential-tool-for-subdomain-enumeration-c1910121d712.md", "source_sha256": "9aa9c0bcf1ee30c6c1d4fb7add81c96c9e5321ff981e51cb5bcd593065f4339e", "evidence_sections": [ "Uncovering Subdomains for Enhanced Reconnaissance: A Comprehensive Guide to Using Sublist3r for Effective OSINT and Penetration Testing", "Installation", "Basic command:" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] } ] }, { "id": "archive:2024/2024-11-07-theharvester-your-essential-tool-for-osint-and-reconnaissance-in-cybersecurity-10aa6d76f5b3", "title": "theHarvester: Your Essential Tool for OSINT and Reconnaissance in Cybersecurity", "url": "https://1200km.com/articles/read/2024/2024-11-07-theharvester-your-essential-tool-for-osint-and-reconnaissance-in-cybersecurity-10aa6d76f5b3/", "kind": "authored", "source_path": "2024/2024-11-07-theharvester-your-essential-tool-for-osint-and-reconnaissance-in-cybersecurity-10aa6d76f5b3.md", "source_sha256": "5d22cf4800262c899151e6307f788e87ad0a3b8116ccb1ce270f6876915d5edc", "evidence_sections": [ "Installation and configuration", "1. Installation of theHarvester", "On Kali Linux (Pre-installed)", "Basic command:" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] } ] }, { "id": "archive:2024/2024-11-09-mastering-the-basics-essential-cli-tools-for-reconnaissance-in-penetration-testing-ee7fd9e36394", "title": "Mastering the Basics: Essential CLI Tools for Reconnaissance in Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-09-mastering-the-basics-essential-cli-tools-for-reconnaissance-in-penetration-testing-ee7fd9e36394/", "kind": "authored", "source_path": "2024/2024-11-09-mastering-the-basics-essential-cli-tools-for-reconnaissance-in-penetration-testing-ee7fd9e36394.md", "source_sha256": "f10de5a01702409835eb4f2832fb525e2ea17a8e473a27dca002b9c1dbf5f87d", "evidence_sections": [ "A Comprehensive Guide to Command Line Tools for Network Exploration: How to Effectively Use Ping, Netdiscover, Whois, and More to Uncover Web Vulnerabilities and Strengthen Security Defenses", "Typical Responses from the ping Command" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] } ] }, { "id": "archive:2024/2024-11-10-censys-for-enhanced-cybersecurity-insight-533df14794bd", "title": "Censys for Enhanced Cybersecurity Insight", "url": "https://1200km.com/articles/read/2024/2024-11-10-censys-for-enhanced-cybersecurity-insight-533df14794bd/", "kind": "authored", "source_path": "2024/2024-11-10-censys-for-enhanced-cybersecurity-insight-533df14794bd.md", "source_sha256": "be95cb786fbe3d3a678a18c86b3404cc8fdaeea7f4916afbe5a58751bc500b8d", "evidence_sections": [ "A professional guide to understanding and utilizing Censys for advanced digital threat intelligence." ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] } ] }, { "id": "archive:2024/2024-11-10-mastering-dirbuster-a-strategic-approach-to-uncovering-hidden-web-assets-31c8406a892b", "title": "Mastering DirBuster: A Strategic Approach to Uncovering Hidden Web Assets", "url": "https://1200km.com/articles/read/2024/2024-11-10-mastering-dirbuster-a-strategic-approach-to-uncovering-hidden-web-assets-31c8406a892b/", "kind": "authored", "source_path": "2024/2024-11-10-mastering-dirbuster-a-strategic-approach-to-uncovering-hidden-web-assets-31c8406a892b.md", "source_sha256": "c68c1c4871b26a4733165fd02abf14a676581fc2e97d6535db1d4c1bac8caaf4", "evidence_sections": [ "Installation", "Step 1: Install Java", "Step 2: Install DirBuster" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] } ] }, { "id": "archive:2024/2024-11-10-unlocking-web-intelligence-a-deep-dive-into-whatweb-8ee4e64ce411", "title": "Unlocking Web Intelligence: A Deep Dive into WhatWeb", "url": "https://1200km.com/articles/read/2024/2024-11-10-unlocking-web-intelligence-a-deep-dive-into-whatweb-8ee4e64ce411/", "kind": "authored", "source_path": "2024/2024-11-10-unlocking-web-intelligence-a-deep-dive-into-whatweb-8ee4e64ce411.md", "source_sha256": "8527fe5479c6e6ea94c5c52e6842cacb99e5a4cb307906d78d39db39e8f351c2", "evidence_sections": [ "Explore how WhatWeb deciphers the technologies powering websites, enhancing security and reconnaissance efforts.", "Installation", "Installation on Linux", "Installation on macOS", "Verifying the Installation", "Advanced Scanning Options" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Advanced Scanning Options" ] } ] }, { "id": "archive:2024/2024-11-10-web-applications-penetretion-testing-stage-1-reconnaissance-6b6b7aae0399", "title": "Web Applications Penetretion Testing. Stage 1: Reconnaissance", "url": "https://1200km.com/articles/read/2024/2024-11-10-web-applications-penetretion-testing-stage-1-reconnaissance-6b6b7aae0399/", "kind": "authored", "source_path": "2024/2024-11-10-web-applications-penetretion-testing-stage-1-reconnaissance-6b6b7aae0399.md", "source_sha256": "19e54f1352e16c304882b473269f11a9becceff016cc4cf5ea28eee8e5e673e2", "evidence_sections": [ "Unveil the first steps in securing web applications by exploring the essential techniques and tools for effective reconnaissance", "2. IP Address Ranges, DNS, WHOIS and Network Information", "Web Application Penetration Testing: Reconnaissance Stage Report" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "5. Directory and File Enumeration", "Web Application Penetration Testing: Reconnaissance Stage Report" ] } ] }, { "id": "archive:2024/2024-11-11-mastering-burp-suite-vulnerability-scanner-019ed82c8bac", "title": "Mastering Burp Suite Vulnerability Scanner", "url": "https://1200km.com/articles/read/2024/2024-11-11-mastering-burp-suite-vulnerability-scanner-019ed82c8bac/", "kind": "authored", "source_path": "2024/2024-11-11-mastering-burp-suite-vulnerability-scanner-019ed82c8bac.md", "source_sha256": "498fbc0ec5d515e412bf16810b9f1450ad1cafc6d4244f18f7131ae1ada55c96", "evidence_sections": [ "From configuration to result analysis, discover how to leverage Burp Suite’s automatic scanner for faster and more effective web security audits.", "Tool Overview: Burp Suite Automatic Vulnerability Scanner", "Running and Using the Automatic Vulnerability Scanner in Burp Suite", "Start the Scan:", "Configure Scan Details:", "Light Scan", "Balanced Scan", "Deep Scan", "Fast Scan" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Tool Overview: Burp Suite Automatic Vulnerability Scanner", "Running and Using the Automatic Vulnerability Scanner in Burp Suite" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Tool Overview: Burp Suite Automatic Vulnerability Scanner", "Running and Using the Automatic Vulnerability Scanner in Burp Suite" ] } ] }, { "id": "archive:2024/2024-11-12-nikto-uncovering-web-server-vulnerabilities-with-an-open-source-scanner-6d2d2fbc1e21", "title": "Nikto: Uncovering Web Server Vulnerabilities with an Open-Source Scanner", "url": "https://1200km.com/articles/read/2024/2024-11-12-nikto-uncovering-web-server-vulnerabilities-with-an-open-source-scanner-6d2d2fbc1e21/", "kind": "authored", "source_path": "2024/2024-11-12-nikto-uncovering-web-server-vulnerabilities-with-an-open-source-scanner-6d2d2fbc1e21.md", "source_sha256": "ae818993e407315cbd49a4eb46b96b5eb572317f178ede63ebee606bc3b6700f", "evidence_sections": [ "1. Linux Installation", "Step-by-Step Installation:", "2. Windows Installation", "Step-by-Step Installation:", "3. macOS Installation", "Step-by-Step Installation:", "3. Vulnerability Findings" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "3. Vulnerability Findings" ] } ] }, { "id": "archive:2024/2024-11-12-owasp-zap-a-comprehensive-guide-to-web-application-security-testing-6c247f4be39b", "title": "OWASP ZAP: A Comprehensive Guide to Web Application Security Testing", "url": "https://1200km.com/articles/read/2024/2024-11-12-owasp-zap-a-comprehensive-guide-to-web-application-security-testing-6c247f4be39b/", "kind": "authored", "source_path": "2024/2024-11-12-owasp-zap-a-comprehensive-guide-to-web-application-security-testing-6c247f4be39b.md", "source_sha256": "c0f3e7e0845d725e8f5599603415ca60d0dd6921a03b0448cb4b3f75e4c9f3fa", "evidence_sections": [ "Using OWASP ZAP for Identifying and Mitigating Web Application Vulnerabilities", "Installation Guide for OWASP ZAP", "Basic Automated Scan", "For ZAP to capture traffic and run scans effectively, configure your browser to use ZAP as a proxy.", "Step 4: Run the Basic Scan", "Step 5: Monitor the Scan Progress", "Deep Scan", "Step 2: Configure the Deep Scan Settings", "Step 3: Initiate the Full Automated Scan", "Step 4: Perform the Active Scan" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Basic Automated Scan", "For ZAP to capture traffic and run scans effectively, configure your browser to use ZAP as a proxy" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Using OWASP ZAP for Identifying and Mitigating Web Application Vulnerabilities" ] } ] }, { "id": "archive:2024/2024-11-13-web-applications-penetretion-testing-stage-2-scanning-and-vulnerability-assessment-15021e81c130", "title": "Web Applications Penetretion Testing. Stage 2: Scanning and Vulnerability Assessment", "url": "https://1200km.com/articles/read/2024/2024-11-13-web-applications-penetretion-testing-stage-2-scanning-and-vulnerability-assessment-15021e81c130/", "kind": "authored", "source_path": "2024/2024-11-13-web-applications-penetretion-testing-stage-2-scanning-and-vulnerability-assessment-15021e81c130.md", "source_sha256": "07b8fa0254ee12d5853069cd43ed719fa808159f58a2ee935085fe6dda4f478d", "evidence_sections": [ "Identifying Weaknesses: Mastering the Art of Scanning and Vulnerability Assessment in Web Application Security", "Scanning Techniques", "1. Network/ports Scanning", "Basic scan:", "Web Application Vulnerability Scanning:", "4. SQL Injection Scanning" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Scanning Techniques", "1. Network/ports Scanning" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Web Application Vulnerability Scanning", "4. SQL Injection Scanning" ] } ] }, { "id": "archive:2024/2024-11-15-2john-9bb0bd44ed64", "title": "2John", "url": "https://1200km.com/articles/read/2024/2024-11-15-2john-9bb0bd44ed64/", "kind": "authored", "source_path": "2024/2024-11-15-2john-9bb0bd44ed64.md", "source_sha256": "b82d70f2442d5a9fbbce7bc042ff8f700192ec5b7964b3fb9a278fce55fa29bd", "evidence_sections": [ "Full list of tools" ], "placements": [ { "stage": "actions-on-objectives", "note": "Supporting reference for converting protected artifacts into password-recovery inputs after lawful acquisition.", "read_sections": [] } ] }, { "id": "archive:2024/2024-11-15-john-the-ripper-hash-formats-f2ec958acaf8", "title": "John The Ripper Hash Formats", "url": "https://1200km.com/articles/read/2024/2024-11-15-john-the-ripper-hash-formats-f2ec958acaf8/", "kind": "authored", "source_path": "2024/2024-11-15-john-the-ripper-hash-formats-f2ec958acaf8.md", "source_sha256": "370a23e366933b050d10b4b9d601a736d6bed942f690d8c50b211f2f9df53ebc", "evidence_sections": [ "Reference", "afs — Kerberos AFS DES", "Supported Hash Formats", "bfegg — Eggdrop", "Supported Hash Formats" ], "placements": [ { "stage": "actions-on-objectives", "note": "Supporting hash-format reference for interpreting password-recovery inputs.", "read_sections": [ "dominosec — More Secure Internet Password" ] } ] }, { "id": "archive:2024/2024-11-15-mastering-john-the-ripper-a-complete-guide-to-password-cracking-e42d68239c71", "title": "Mastering John the Ripper: A Complete Guide to Password Cracking", "url": "https://1200km.com/articles/read/2024/2024-11-15-mastering-john-the-ripper-a-complete-guide-to-password-cracking-e42d68239c71/", "kind": "authored", "source_path": "2024/2024-11-15-mastering-john-the-ripper-a-complete-guide-to-password-cracking-e42d68239c71.md", "source_sha256": "e26b6afbad55401bd6b8b8dcf72055f0dd9fcf6b0737b02ba73b9860e3a6b52d", "evidence_sections": [ "Installation", "Basic Command Structure:", "Common Command-Line Options:" ], "placements": [ { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "The Why and Where of Password Hashing" ] } ] }, { "id": "archive:2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82", "title": "The Basic Toolkit for Penetration Testing", "url": "https://1200km.com/articles/read/2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82/", "kind": "authored", "source_path": "2024/2024-11-16-the-basic-toolkit-for-penetration-testing-303da9234d82.md", "source_sha256": "1ea93d2f42c89cf3a886e2511a7366b7a600d6f3a2aee3b2f2d91a825e6fd21b", "evidence_sections": [ "Unlocking Vulnerabilities: A Comprehensive Guide to Essential Tools for Pen Testing", "Reconnaissance and OSINT Tools", "Vulnerability Scanning and Enumeration", "Network Scanning", "Exploitation Tools", "Post-Exploitation and Lateral Movement Tools" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Reconnaissance and OSINT Tools", "Vulnerability Scanning and Enumeration" ] }, { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Unlocking Vulnerabilities: A Comprehensive Guide to Essential Tools for Pen Testing", "Vulnerability Scanning and Enumeration" ] } ] }, { "id": "archive:2024/2024-11-17-the-ultimate-guide-to-metasploit-part-1-43c8573487df", "title": "The Ultimate Guide to Metasploit. Part 1.", "url": "https://1200km.com/articles/read/2024/2024-11-17-the-ultimate-guide-to-metasploit-part-1-43c8573487df/", "kind": "authored", "source_path": "2024/2024-11-17-the-ultimate-guide-to-metasploit-part-1-43c8573487df.md", "source_sha256": "5135521c6ae69fb77bc201fecae415bdb2eab6cdae9efef969037c2f8a921452", "evidence_sections": [ "A Complete Guide to Exploiting Vulnerabilities and Strengthening Security with Metasploit", "Installation", "Viewing Vulnerabilities", "List Available Payloads", "Here are three example msfvenom commands using different flags, along with their explanations:", "Example 1 demonstrates a basic payload generation.", "Example 2 showcases the use of encoders to evade detection.", "Example 3 illustrates how to embed a payload into a legitimate application for stealth.", "1. Identify a Vulnerable Service", "You can search in https://www.exploit-db.com/", "3. Search for mode for vulnerability:", "3. Choose an Exploit", "4. Show exploit configuration:", "5. Run the exploit", "7.Use help command to see all options:" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "List Available Payloads", "Example 1 demonstrates a basic payload generation" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "A Complete Guide to Exploiting Vulnerabilities and Strengthening Security with Metasploit", "Viewing Vulnerabilities" ] } ] }, { "id": "archive:2024/2024-11-18-metasploit-modules-guide-auxiliary-1821db1712f0", "title": "Metasploit modules guide. Auxiliary", "url": "https://1200km.com/articles/read/2024/2024-11-18-metasploit-modules-guide-auxiliary-1821db1712f0/", "kind": "authored", "source_path": "2024/2024-11-18-metasploit-modules-guide-auxiliary-1821db1712f0.md", "source_sha256": "942658bf0e191556897e47ab2719d2b7ba330ee1c4318d4b445bf9aa8b54e770", "evidence_sections": [ "Standart commands:", "1. Scanners", "4. Vulnerability Scanners", "5. Network Discovery" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "1. Scanners", "4. Vulnerability Scanners" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "4. Vulnerability Scanners" ] } ] }, { "id": "archive:2024/2024-11-20-how-to-create-a-vulnerable-windows-virtual-machine-for-pentesting-training-with-scripts-6dc39f0b3bb3", "title": "How to Create a Vulnerable Windows Virtual Machine for Pentesting Training with scripts!", "url": "https://1200km.com/articles/read/2024/2024-11-20-how-to-create-a-vulnerable-windows-virtual-machine-for-pentesting-training-with-scripts-6dc39f0b3bb3/", "kind": "authored", "source_path": "2024/2024-11-20-how-to-create-a-vulnerable-windows-virtual-machine-for-pentesting-training-with-scripts-6dc39f0b3bb3.md", "source_sha256": "067ea74892e5c39ebebaf8e277808dfc79e62c65928818c139ca31b637e3e507", "evidence_sections": [ "Building Your Cybersecurity Playground: Step-by-Step Guide to Creating a Vulnerable Windows VM for Ethical Hacking Practice", "3. Introducing Vulnerabilities", "Disable User Account Control (UAC)", "Enable SMB Using Command Prompt" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "3. Introducing Vulnerabilities" ] } ] }, { "id": "archive:2024/2024-11-24-title-metasploit-modules-guide-exploit-73eecb50e3c3", "title": "Title Metasploit modules guide. Exploit", "url": "https://1200km.com/articles/read/2024/2024-11-24-title-metasploit-modules-guide-exploit-73eecb50e3c3/", "kind": "authored", "source_path": "2024/2024-11-24-title-metasploit-modules-guide-exploit-73eecb50e3c3.md", "source_sha256": "b620ef474fa673e9f526bf366d2a6fa0439812200a56df5bfef8833d36a7d095", "evidence_sections": [ "Complete Explanation of Exploit Mode in Metasploit", "Standard Commands", "Exploit Module Categories", "1. Remote Exploits", "2. Local Exploits", "3. Web Application Exploits", "5. Client-Side Exploits", "6. Auxiliary-Driven Exploits", "Tips for Using Exploit Modules" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Complete Explanation of Exploit Mode in Metasploit", "Exploit Module Categories" ] } ] }, { "id": "archive:2025/2025-02-24-soc-tier-1-the-complete-onboarding-guide-to-security-monitoring-and-incident-response-824a1dfe4476", "title": "SOC Tier 1: The Complete Onboarding Guide to Security Monitoring and Incident Response", "url": "https://1200km.com/articles/read/2025/2025-02-24-soc-tier-1-the-complete-onboarding-guide-to-security-monitoring-and-incident-response-824a1dfe4476/", "kind": "authored", "source_path": "2025/2025-02-24-soc-tier-1-the-complete-onboarding-guide-to-security-monitoring-and-incident-response-824a1dfe4476.md", "source_sha256": "4a879dfd75a96e383437e71d8765ab11ff9e3195cd2601cd8eda218131b6c723", "evidence_sections": [ "3. Tier 3: SOC Investigator / Threat Hunter", "2. Common Threats and Attack Types", "1. Reconnaissance", "2. Weaponization and Delivery", "3. Exploitation", "4. Installation", "5. Command and Control (C2)" ], "placements": [ { "stage": "exploitation", "note": "Defensive support: SOC triage and event interpretation help establish access and execution evidence.", "read_sections": [ "3. Exploitation" ] }, { "stage": "installation", "note": "Defensive support: process, service, and state-change analytics help investigate a foothold; validate required event fields and benign controls.", "read_sections": [] }, { "stage": "command-and-control", "note": "Defensive support: use network indicators, periodicity, and correlated events to test a C2 hypothesis, not infer a malware family from one alert.", "read_sections": [ "5. Command and Control (C2)" ] }, { "stage": "actions-on-objectives", "note": "Defensive support: connect data movement, identity abuse, and business impact to a tested detection or incident hypothesis.", "read_sections": [ "6. Actions on Objectives" ] } ] }, { "id": "archive:2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939", "title": "Authenticator.exe/DearSteeler", "url": "https://1200km.com/articles/read/2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939/", "kind": "authored", "source_path": "2025/2025-03-14-authenticator-exe-dearsteeler-0c1d69767939.md", "source_sha256": "4b336f3f9164332272d1d3479a5bdc3aa15d6761b3f46727badc70a03d91131a", "evidence_sections": [ "Malware research report", "Malware Overview", "Static Analysis", "Threat Intelligence Lookup", "Malware Classification & TTPs", "Malware Analysis Report Summary:", "Static Analysis", "Strings:", "Threat Intelligence Lookup", "Threat Intelligence Lookup", "Network Traffic Analysis", "Installation and Usage:", "Malware Classification & TTPs" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Registry Modifications" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "Network Traffic Analysis", "C2 Domain and IP" ] } ] }, { "id": "archive:2025/2025-03-24-spw-aw25-po-010-sms-exe-exe-agenttesla-767fbc920295", "title": "SPW AW25 — PO.010 SMS.exe.exe (AgentTesla)", "url": "https://1200km.com/articles/read/2025/2025-03-24-spw-aw25-po-010-sms-exe-exe-agenttesla-767fbc920295/", "kind": "authored", "source_path": "2025/2025-03-24-spw-aw25-po-010-sms-exe-exe-agenttesla-767fbc920295.md", "source_sha256": "e51a0f13d92ea13966b835e159dccd171a50972cfa25102e8683d94861921b0d", "evidence_sections": [ "Malware research report", "Malware Overview", "Static Analysis", "Threat Intelligence Lookup", "Static Analysis Summary", "Probable Behavior and Functionality of the Malware", "Threat Intelligence Lookup: AgentTesla", "Exploitation:", "Impact:" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "The unpacked files are now available for download and further analysis", "Lets download and analyse next file" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] } ] }, { "id": "archive:2025/2025-03-29-static-malware-analysis-strings-analysis-e876640cfdb0", "title": "Static Malware Analysis. Strings analysis.", "url": "https://1200km.com/articles/read/2025/2025-03-29-static-malware-analysis-strings-analysis-e876640cfdb0/", "kind": "authored", "source_path": "2025/2025-03-29-static-malware-analysis-strings-analysis-e876640cfdb0.md", "source_sha256": "130e2281becade4e1cb599da255282126cfbe9fc4d5ade6f056eb7e81ab84140", "evidence_sections": [ "Understanding Strings", "What are Strings in a File?", "Why Are Strings Included in Files?", "Why Strings Matter in Malware Analysis?", "Here’s a more sophisticated example of a C++ function demonstrating the use of multiple hardcoded strings:", "Types of Strings to Look For", "User-Agent Strings :", "CMD or PowerShell Commands :", "Tools for Analyzing Strings in Malware", "My Own Tool — String Analyser", "1. String Extraction", "2. Pattern Detection & Decoding", "Using the ‘strings’ Utility", "Windows Command: findstr" ], "placements": [ { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Registry Keys" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] } ] }, { "id": "archive:2025/2025-03-30-static-malware-analysis-obfuscation-51de3992065d", "title": "Static Malware Analysis . Obfuscation.", "url": "https://1200km.com/articles/read/2025/2025-03-30-static-malware-analysis-obfuscation-51de3992065d/", "kind": "authored", "source_path": "2025/2025-03-30-static-malware-analysis-obfuscation-51de3992065d.md", "source_sha256": "58c642b0ceded8ac38d386f0ed15eaaffeab5d29e14ef6405eee3882db9e0e20", "evidence_sections": [ "Understanding Code Obfuscation in Malware", "Why Do Malware Authors Use Obfuscation?", "1. Control Flow Obfuscation", "2. String Encryption and Encoding", "Tools for Analyzing Obfuscated Malware" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Understanding Code Obfuscation in Malware", "What is Code Obfuscation?" ] } ] }, { "id": "archive:2025/2025-04-01-static-malware-analysis-file-fingerprinting-3ddf9bdd7864", "title": "Static Malware Analysis. File Fingerprinting", "url": "https://1200km.com/articles/read/2025/2025-04-01-static-malware-analysis-file-fingerprinting-3ddf9bdd7864/", "kind": "authored", "source_path": "2025/2025-04-01-static-malware-analysis-file-fingerprinting-3ddf9bdd7864.md", "source_sha256": "5a68dc47bf0bb028efe1d3e99e34cb7b1808207cc6db25b9067142c6df646ab5", "evidence_sections": [ "File Hashes: A Critical Component in Malware Analysis", "Why File Hashes Are Essential in Malware Analysis", "How Can Hackers Exploit Digital Signatures?" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "My own custom Lightweight Utility for Analyzing File Structure and Signatures" ] } ] }, { "id": "archive:2025/2025-04-17-deep-dive-automating-static-malware-analysis-with-three-python-tools-46a26c0a7f87", "title": "Deep Dive: Automating Static Malware Analysis with Three Python Tools", "url": "https://1200km.com/articles/read/2025/2025-04-17-deep-dive-automating-static-malware-analysis-with-three-python-tools-46a26c0a7f87/", "kind": "authored", "source_path": "2025/2025-04-17-deep-dive-automating-static-malware-analysis-with-three-python-tools-46a26c0a7f87.md", "source_sha256": "806c4321a965510da889e0a87e359703710255a8c82f21e71df9ba633a16b68a", "evidence_sections": [ "Static malware analysis involves multiple stages, each revealing different facets of a sample’s behavior. Automating these stages ensures consistency, speed, and depth. Below, I present three Python tools that I’ve developed and open-sourced on GitHub. For each, you’ll find", "Installation", "2. String Analysis with String Analyzer", "Installation", "WINDOWS API COMMANDS:", "Installation" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "OBFUSCATED" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] } ] }, { "id": "archive:2025/2025-06-17-tools-by-mitre-att-and-ck-guide-77c4d947ba36", "title": "Tools by MITRE ATT&CK Guide", "url": "https://1200km.com/articles/read/2025/2025-06-17-tools-by-mitre-att-and-ck-guide-77c4d947ba36/", "kind": "authored", "source_path": "2025/2025-06-17-tools-by-mitre-att-and-ck-guide-77c4d947ba36.md", "source_sha256": "5ad751b0b0abccf9d842302ae5e87c897053fb2e578feb0722bf5c4828eb0a6c", "evidence_sections": [ "Reconnecense", "Active Scanning", "T1595.001 — Scanning IP Blocks", "Tools & Command Examples:", "1. Nmap The Swiss Army knife of network scanning.", "3. Netdiscover ARP-based host discovery in internal networks.", "T1595.002 — Vulnerability Scanning", "Tools & Command Examples", "T1595.003 — Wordlist Scanning", "Tools & Command Examples" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Reconnecense", "Active Scanning" ] } ] }, { "id": "archive:2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f", "title": "Fluent Bit on AWS-EKS: Centralized Kubernetes Log Shipping to XPLG", "url": "https://1200km.com/articles/read/2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f/", "kind": "authored", "source_path": "2025/2025-07-08-fluent-bit-on-aws-eks-centralized-kubernetes-log-shipping-to-xplg-78811b8db55f.md", "source_sha256": "4df2a26edd7358dd61abc382d09e40bf252bea1c2317baae39926f43e30e75e6", "evidence_sections": [ "Deploy Fluent Bit as a DaemonSet with full metadata enrichment, RBAC, and HTTP output to XPLG for real-time observability", "What is Fluent Bit?", "What is XPLG?", "Prerequisites", "What is a DaemonSet in AWS EKS?" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2025/2025-07-09-threat-hunting-with-the-pyramid-of-pain-8add3cedb380", "title": "Threat Hunting with the Pyramid of Pain", "url": "https://1200km.com/articles/read/2025/2025-07-09-threat-hunting-with-the-pyramid-of-pain-8add3cedb380/", "kind": "authored", "source_path": "2025/2025-07-09-threat-hunting-with-the-pyramid-of-pain-8add3cedb380.md", "source_sha256": "6db49183e10aea572d73037e53b9b9f95057874f25c9dd25ea8423e4fe808646", "evidence_sections": [ "A practical guide to using threat indicators that actually hurt your attackers, based on David J. Bianco’s model. Why detecting TTPs is more powerful than blocking IPs — and how to use that to your advantage" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba", "title": "FluentBit on Kubernetes DemonSet Deployment.", "url": "https://1200km.com/articles/read/2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba/", "kind": "authored", "source_path": "2025/2025-07-11-fluentbit-on-kubernetes-demonset-deployment-13c3915113ba.md", "source_sha256": "dc3d6a3a19e8168182b9c54e9e9f99cc2f4accdc270cca415fd21e4a1486ef99", "evidence_sections": [ "Fluent Bit Offset Persistence", "Fluent Bit Offset Persistence Strategies: In-Memory, HostPath, and Shared RWX Storage:", "2. HostPath-Backed DB (Per-Node Persistence)", "3. Shared RWX Volume (Cluster-Wide Persistence)", "Deploying Fluent Bit with Cluster-Wide Persistence on Kubernetes (EKS + EFS)", "3. Install EFS CSI Driver" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2025/2025-07-11-sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b", "title": "Sending EKS Control Plane Logs via AWS Lambda", "url": "https://1200km.com/articles/read/2025/2025-07-11-sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b/", "kind": "authored", "source_path": "2025/2025-07-11-sending-eks-control-plane-logs-via-aws-lambda-c4ce0cf84c5b.md", "source_sha256": "32a6d4c9c34320ecea4db2ab0387f38d9968638ccf3e0e91d0fa355e63155702", "evidence_sections": [ "A step-by-step guide to forwarding Amazon EKS control plane logs to SIEM/LogCOllector/XPLG using a lightweight AWS-native Lambda integration.", "What Are Control Plane Logs in EKS?", "Main Types of Control Plane Logs", "Why Use Control Plane Logs?", "Why You Can’t Forward EKS Control Plane Logs Directly to SIEM/XPLG", "1. Control Plane Is Fully Managed by AWS", "2. Control Plane Logs Are Only Available via CloudWatch" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54", "title": "Cyberattacks on 4G/LTE Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54/", "kind": "authored", "source_path": "2025/2025-07-20-cyberattacks-on-4g-lte-telecom-networks-threat-mapping-and-defense-bd0e7fe76f54.md", "source_sha256": "97f60d8d8833af759cff13a7285effa47aecce148f5aac48c43a53a2f5e97690", "evidence_sections": [ "This research provides an in-depth analysis of cyber threats targeting LTE telecom core networks, mapping real-world and theoretical attack techniques to the MITRE ATT&CK and FiGHT frameworks. It includes practical detection methods and mitigation strategies, tailored specifically for Ericsson systems and infrastructure.", "Threats in 4G LTE/EPC Connection Flow", "Stage 1: Access Network (UE to eNodeB via Uu)", "Threats & Techniques:", "Adversary Exploitation:", "Detection:", "Stage 2: Core Network Attach & Authentication (S1-MME, S6a Interfaces)", "Threats & Techniques:", "Adversary Exploitation:", "Detection:", "Threats & Techniques:", "Adversary Exploitation:", "Detection:", "Threats & Techniques:", "Adversary Exploitation:", "Detection:" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Stage 1: Access Network (UE to eNodeB via Uu)", "Adversary Exploitation" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ] }, { "id": "archive:2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df", "title": "Cyberattacks on 5G Telecom Networks: Threat Mapping and Defense", "url": "https://1200km.com/articles/read/2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df/", "kind": "authored", "source_path": "2025/2025-07-20-cyberattacks-on-5g-telecom-networks-threat-mapping-and-defense-aa74f680a7df.md", "source_sha256": "15ee0009fcf54767be5fc75dd862e0ff410350965b26663162c19b5d5ccbe935", "evidence_sections": [ "This research provides an in-depth analysis of cyber threats targeting 5G telecom core networks, mapping real-world and theoretical attack techniques to the MITRE ATT&CK and FiGHT frameworks. It includes practical detection methods and mitigation strategies, tailored specifically for Ericsson systems and infrastructure.", "Threats in 5G Core (Service-Based Architecture) Connection Flow", "Threats & Techniques:", "Adversary Exploitation:", "Detection:", "Stage 2: Core Network Registration & Authentication (N1, N2, N8 interfaces)", "Threats & Techniques:", "Adversary Exploitation:", "Detection:", "Threats & Techniques:", "Adversary Exploitation:", "Detection:", "Stage 4: User-Plane Traffic in 5G (UE to Data Network via UPF — N3, N6 interfaces)", "Threats & Techniques:", "Adversary Exploitation:", "Detection (Ericsson Logs & Tools):" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Stage 1: 5G Radio Access (UE to gNB, NG-RAN)", "Adversary Exploitation" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ] }, { "id": "archive:2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c", "title": "Information Security Awareness: Principles and Best Practices for Employees", "url": "https://1200km.com/articles/read/2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c/", "kind": "authored", "source_path": "2025/2025-07-25-information-security-awareness-principles-and-best-practices-for-employees-6e518eda752c.md", "source_sha256": "83b57bc2616fc9596807ad4fe5fe887cb0ba146ce57630f25b37cd1b7a6306ac", "evidence_sections": [ "Common Threats to Information Security", "Key Policies and Controls in an Information Security Program (ISMS)" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [] } ] }, { "id": "archive:2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511", "title": "Phishing Email Awareness: Protecting Employees and Organizations", "url": "https://1200km.com/articles/read/2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511/", "kind": "authored", "source_path": "2025/2025-07-25-phishing-email-awareness-protecting-employees-and-organizations-cf5bc57a0511.md", "source_sha256": "bd0f747919d88d1287eeb85067070425d19e7e577f6f88d425d8ec4afd34aec2", "evidence_sections": [ "What is Email Phishing and Why It’s Dangerous", "The Scale of the Phishing Threat (By the Numbers)", "Notable Phishing Attacks in Recent Years", "Phishing as a Gateway to Bigger Threats", "Common Phishing Techniques and Tactics", "Spotting a Phishing Email: Anatomy of an Attack", "Defending Against Phishing: Tools and Techniques", "Best Practices for Employees to Avoid Phishing Scams" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "What is Email Phishing and Why It’s Dangerous", "The Scale of the Phishing Threat (By the Numbers)" ] } ] }, { "id": "archive:2025/2025-07-27-quick-start-server-hardening-checklist-all-open-source-08e9887b9faa", "title": "Quick‑Start Server Hardening Checklist (all open‑source)", "url": "https://1200km.com/articles/read/2025/2025-07-27-quick-start-server-hardening-checklist-all-open-source-08e9887b9faa/", "kind": "authored", "source_path": "2025/2025-07-27-quick-start-server-hardening-checklist-all-open-source-08e9887b9faa.md", "source_sha256": "c9681f94d2dd43c591f73633c282993a9e24ad91b239849152831716673e3414", "evidence_sections": [ "ISO 27001-Based Server Hardening Plan", "1. Access Control (ISO 27001 — A.9)", "2. System & Network Hardening (ISO 27001 — A.13, A.12.6.1)", "7. Encryption (A.10)", "8. Malware and Rootkit Detection (A.12.2.1)" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "ISO 27001-Based Server Hardening Plan", "1. Access Control (ISO 27001 — A.9)" ] } ] }, { "id": "archive:2025/2025-08-01-the-20x-employee-a-strategic-framework-for-unlocking-hyper-productivity-with-artificial-8f49cde95a25", "title": "The 20x Employee: A Strategic Framework for Unlocking Hyper-Productivity with Artificial…", "url": "https://1200km.com/articles/read/2025/2025-08-01-the-20x-employee-a-strategic-framework-for-unlocking-hyper-productivity-with-artificial-8f49cde95a25/", "kind": "authored", "source_path": "2025/2025-08-01-the-20x-employee-a-strategic-framework-for-unlocking-hyper-productivity-with-artificial-8f49cde95a25.md", "source_sha256": "094e47663a4ffd90adfb998ba5b60ede20619ba6a640ce1ea3481029539dd7b1", "evidence_sections": [ "Defensive AI: The Strategic Response to Machine-Speed Threats", "2.3 Layer 2: The Analyst’s Copilot for Investigation and Threat Hunting" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2025/2025-08-31-from-bugs-to-breaches-learning-secure-coding-through-the-owasp-top-10-21b425fafb83", "title": "From Bugs to Breaches: Learning Secure Coding Through the OWASP Top 10", "url": "https://1200km.com/articles/read/2025/2025-08-31-from-bugs-to-breaches-learning-secure-coding-through-the-owasp-top-10-21b425fafb83/", "kind": "authored", "source_path": "2025/2025-08-31-from-bugs-to-breaches-learning-secure-coding-through-the-owasp-top-10-21b425fafb83.md", "source_sha256": "49ce7f6371076e75b9d8a51e364fe394c5c3b1a47f7232a2042dd96c5f53dc0c", "evidence_sections": [ "A01: Broken Access Control", "The Vulnerable Code", "Primary Defense: Separate Data from Commands", "Conclusion: The Business Impact", "How to Fix It: Automation and Hardening", "A06: Vulnerable and Outdated Components", "The Devastating Impact in Cloud Environments" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "A01: Broken Access Control", "A03: Injection — A Comprehensive Guide" ] } ] }, { "id": "archive:2025/2025-10-13-villager-the-ai-powered-penetration-testing-framework-8df10532e265", "title": "Villager: The AI-Powered Penetration Testing Framework", "url": "https://1200km.com/articles/read/2025/2025-10-13-villager-the-ai-powered-penetration-testing-framework-8df10532e265/", "kind": "authored", "source_path": "2025/2025-10-13-villager-the-ai-powered-penetration-testing-framework-8df10532e265.md", "source_sha256": "fd77d7261666245f4c03cacc74be3ed9b9048709fcbf96de9dc243d328b01db8", "evidence_sections": [ "A New Generation of Offensive AI", "Inside Villager’s Architecture", "What It Can Do", "Ethical Use vs. Weaponization", "Defensive Implications" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "archive:2025/2025-10-14-the-invisible-pipeline-defending-ci-cd-from-targeted-attacks-456283ee5ed3", "title": "The Invisible Pipeline: Defending CI/CD from Targeted Attacks", "url": "https://1200km.com/articles/read/2025/2025-10-14-the-invisible-pipeline-defending-ci-cd-from-targeted-attacks-456283ee5ed3/", "kind": "authored", "source_path": "2025/2025-10-14-the-invisible-pipeline-defending-ci-cd-from-targeted-attacks-456283ee5ed3.md", "source_sha256": "c7a63b36dbdfbc1575b3169d27fb66eacde047b08f37ad2815ce45f367da4461", "evidence_sections": [ "How adversaries weaponize build systems — and the concrete tools & controls you can use to stop them", "D. Build agent takeover (docker socket, vulnerable base images)", "Identity & credentials: short-lived, auditable tokens", "Pipeline hardening & policy", "Static & dynamic analysis (tooling)", "Logging, detection & runtime controls", "5) Detection & incident response (playbook outline)" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "How adversaries weaponize build systems — and the concrete tools & controls you can use to stop them", "E. Artifact repository compromise (Nexus, Artifactory, GitHub Packages)" ] }, { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "Supply-chain integrity" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "B. Dependency/registry poisoning (typosquatting, dependency confusion)" ] } ] }, { "id": "archive:2025/2025-10-18-automating-a-safe-dvwa-lab-with-ansible-build-a-reproducible-vulnerable-environment-for-tr-026d74697c4a", "title": "Automating a Safe DVWA Lab with Ansible: Build a Reproducible Vulnerable Environment for Training…", "url": "https://1200km.com/articles/read/2025/2025-10-18-automating-a-safe-dvwa-lab-with-ansible-build-a-reproducible-vulnerable-environment-for-tr-026d74697c4a/", "kind": "authored", "source_path": "2025/2025-10-18-automating-a-safe-dvwa-lab-with-ansible-build-a-reproducible-vulnerable-environment-for-tr-026d74697c4a.md", "source_sha256": "01698e878388f2e8219ab0374bda69c42f61717ee2eeef0f4b9d604c368a9f52", "evidence_sections": [ "Automating a Safe DVWA Lab with Ansible: Build a Reproducible Vulnerable Environment for Training and Research", "How to deploy Damn Vulnerable Web App in minutes inside an isolated Docker lab — repeatable, auditable, and safe for every cybersecurity team.", "3) Install Ansible & dependencies (control machine)" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "archive:2025/2025-10-19-augmenting-digital-forensics-with-ai-how-chatgpt-transforms-investigation-workflows-34eb10887ea5", "title": "Augmenting Digital Forensics with AI: How ChatGPT Transforms Investigation Workflows", "url": "https://1200km.com/articles/read/2025/2025-10-19-augmenting-digital-forensics-with-ai-how-chatgpt-transforms-investigation-workflows-34eb10887ea5/", "kind": "authored", "source_path": "2025/2025-10-19-augmenting-digital-forensics-with-ai-how-chatgpt-transforms-investigation-workflows-34eb10887ea5.md", "source_sha256": "12f107b1659f21dde8e9e6404177eb719c9fa8ead11b222e2827a37d5e5474a2", "evidence_sections": [ "Reconstructed timeline (representative; exact minute granularity available in CSV)" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2025/2025-10-20-meet-syscheck-beauty-a-colorful-linux-system-report-with-deep-storage-insights-and-exporta-a38329dfe085", "title": "Meet syscheck_beauty: a colorful Linux system report with deep storage insights (and exportable…", "url": "https://1200km.com/articles/read/2025/2025-10-20-meet-syscheck-beauty-a-colorful-linux-system-report-with-deep-storage-insights-and-exporta-a38329dfe085/", "kind": "authored", "source_path": "2025/2025-10-20-meet-syscheck-beauty-a-colorful-linux-system-report-with-deep-storage-insights-and-exporta-a38329dfe085.md", "source_sha256": "bfab7c378a767dd459f7420ae64e7d414dd5b01b82a7356396a20d2ef12ebb55", "evidence_sections": [ "TL;DR : I built a single-file Python tool that prints a beautiful, color-coded snapshot of your Linux machine — CPU, memory, GPU, disks, filesystems — and can optionally scan for the heaviest directories/files. It also exports a polished, responsive HTML report you can share with teammates or stash in tickets.", "Command options" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2025/2025-11-01-the-atomic-standard-a-practitioner-s-compendium-for-single-event-threat-detection-570c4241d4d9", "title": "The Atomic Standard: A Practitioner’s Compendium for Single-Event Threat Detection", "url": "https://1200km.com/articles/read/2025/2025-11-01-the-atomic-standard-a-practitioner-s-compendium-for-single-event-threat-detection-570c4241d4d9/", "kind": "authored", "source_path": "2025/2025-11-01-the-atomic-standard-a-practitioner-s-compendium-for-single-event-threat-detection-570c4241d4d9.md", "source_sha256": "c901e7f1d6fbdb3fb1a561eb08a3ff097da74093e425cef91662370fa159b3da", "evidence_sections": [ "Part 1: The Theoretical Foundation of Atomic Detection", "1.3 Detection Engineering as a Discipline (Detection-as-Code)" ], "placements": [ { "stage": "installation", "note": "Defensive support: process, service, and state-change analytics help investigate a foothold; validate required event fields and benign controls.", "read_sections": [] }, { "stage": "command-and-control", "note": "Defensive support: use network indicators, periodicity, and correlated events to test a C2 hypothesis, not infer a malware family from one alert.", "read_sections": [] } ] }, { "id": "archive:2025/2025-11-02-deploying-fluent-bit-as-a-windows-service-for-centralized-log-forwarding-baec55b8aaf8", "title": "Deploying Fluent Bit as a Windows Service for Centralized Log Forwarding", "url": "https://1200km.com/articles/read/2025/2025-11-02-deploying-fluent-bit-as-a-windows-service-for-centralized-log-forwarding-baec55b8aaf8/", "kind": "authored", "source_path": "2025/2025-11-02-deploying-fluent-bit-as-a-windows-service-for-centralized-log-forwarding-baec55b8aaf8.md", "source_sha256": "767ad6a57878556ea371fc7d27caefe60be3cdd93f6d30801301beacc3f707cd", "evidence_sections": [ "2. Install Fluent Bit", "4. Install as a Windows Service" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1", "title": "Cloud-Native Security Threats, Attacks, and Detection Strategies", "url": "https://1200km.com/articles/read/2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1/", "kind": "authored", "source_path": "2025/2025-11-07-cloud-native-security-threats-attacks-and-detection-strategies-55b3dd6ea2d1.md", "source_sha256": "6455f8a897a5c8d312a29f0ab11a0bfeab6ef8e2619e24c6e70740192bcfe88f", "evidence_sections": [ "Securing Cloud‑Native Environments — A Comprehensive Guide to Kubernetes Threats, Detection Techniques, Real‑World Attack Insights, and Top Security Certifications. This option delivers an authoritative, matter-of-fact summary of the article’s scope. It clearly enumerates the coverage of cloud-native threat analysis, detection methods, case studies of real attacks, and guidance on industry-leading certifications, signaling a thorough and credible resource for security professionals", "Major Threat Categories in Cloud-Native Environments", "Detection and Mitigation Strategies for Cloud-Native Threats", "Runtime Threat Detection Tools", "Detection Rules and Methodologies (SIGMA, EQL, etc.)", "Example Detection Use-Cases" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ] }, { "id": "archive:2025/2025-11-23-spiderfoot-deep-dive-installation-scans-and-practical-use-cases-11ea6537ad6f", "title": "SpiderFoot Deep Dive: Installation, Scans, and Practical Use Cases", "url": "https://1200km.com/articles/read/2025/2025-11-23-spiderfoot-deep-dive-installation-scans-and-practical-use-cases-11ea6537ad6f/", "kind": "authored", "source_path": "2025/2025-11-23-spiderfoot-deep-dive-installation-scans-and-practical-use-cases-11ea6537ad6f.md", "source_sha256": "59b1ca05b2242ae66ab8d77268403a3cdd21637681f7395323f957ff449bcbd2", "evidence_sections": [ "How to run SpiderFoot, pick the right modules, interpret results, and use it responsibly for threat intelligence and reconnaissance.", "Installation", "Running Scans: Targets, Profiles, and Modules" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Running Scans: Targets, Profiles, and Modules" ] } ] }, { "id": "archive:2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5", "title": "Reinventing Recon: Nmap Meets ChatGPT", "url": "https://1200km.com/articles/read/2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5/", "kind": "authored", "source_path": "2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5.md", "source_sha256": "6580ded0945cbd8a282299cf445cbaa6f8d43a2a81a4b57bf6c26fdd4cf088a7", "evidence_sections": [ "Vulnerabilities & misconfigurations (explicit list)", "Vulnerabilities & misconfigurations (explicit list)", "5) Detection & hunting playbook", "High-value detection rules / SIEM searches (prioritized)", "B — Machine-readable summary (`scan_summary` JSON)" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "B — Machine-readable summary (`scan_summary` JSON)" ] } ] }, { "id": "archive:2025/2025-11-25-getting-more-from-burp-suite-with-llms-fdd03cec343d", "title": "Getting More from Burp Suite with LLMs", "url": "https://1200km.com/articles/read/2025/2025-11-25-getting-more-from-burp-suite-with-llms-fdd03cec343d/", "kind": "authored", "source_path": "2025/2025-11-25-getting-more-from-burp-suite-with-llms-fdd03cec343d.md", "source_sha256": "d823425e8aca8a6ee789fdae89825128d2488e8cc7be2f51082cf92ec51f0b1b", "evidence_sections": [ "How ChatGPT Accelerates Scan Analysis, Prioritization and Mitigation. Practical workflow and prompt recipes for turning Burp scan output into actionable findings, prioritized remediation, and next-step playbooks for penetration testers.", "1) Run a new scan in Burp Suite", "2) When the scan finishes — export selected issues" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Executive summary" ] } ] }, { "id": "archive:2025/2025-11-26-enhancing-penetration-testing-with-hackerai-step-by-step-guide-metasploitable-lab-b2ab2cdd4139", "title": "Enhancing Penetration Testing with HackerAI: Step-by-Step Guide (Metasploitable Lab)", "url": "https://1200km.com/articles/read/2025/2025-11-26-enhancing-penetration-testing-with-hackerai-step-by-step-guide-metasploitable-lab-b2ab2cdd4139/", "kind": "authored", "source_path": "2025/2025-11-26-enhancing-penetration-testing-with-hackerai-step-by-step-guide-metasploitable-lab-b2ab2cdd4139.md", "source_sha256": "a3a2692eacee39c1d4f5baa62961c06fce84daf6588058747735d335d2d56ca5", "evidence_sections": [ "Learn how to integrate AI into every phase of the penetration testing kill chain with classic tools and a vulnerable lab VM.", "Step 1: Reconnaissance and Scanning with Nmap", "Step 2: Upload scan result to HackerAI:", "**CRITICAL VULNERABILITIES (Immediate Root Access)**", "**HIGH-PRIORITY VULNERABILITIES**", "**Enumeration and Further Exploitation Targets**", "Step 3: Exploitation — Gaining Initial Access (vsftpd Backdoor)", "Step 4: Post-Exploitation and Privilege Escalation" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "**CRITICAL VULNERABILITIES (Immediate Root Access)**", "**HIGH-PRIORITY VULNERABILITIES**" ] } ] }, { "id": "archive:2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd", "title": "Single-Event Detection Rules in Cybersecurity", "url": "https://1200km.com/articles/read/2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd/", "kind": "authored", "source_path": "2025/2025-12-01-single-event-detection-rules-in-cybersecurity-aa7498f665bd.md", "source_sha256": "892b4d69ca7667ef166c3197e68f9616d55c9b47b0d521a366ba025df0bce5a7", "evidence_sections": [ "3. Persistence Creation (Service Installed / Startup Script Edited)", "4. Malware Execution (Suspicious Process or Hash)", "5. Suspicious Command-Line (PowerShell Download String)", "6. Data Exfiltration (Netcat or cURL to External IP)", "8. Credential Dumping (LSASS Access)", "10. Public Exploit Indicators (Scanning for Known Paths)", "13. Network Scanning (Nmap User-Agent or SYN Scan)", "15. Exploit Attempts (SQL Injection or XSS Patterns)", "Comparative Analysis: Single-Event vs. Correlation Detections" ], "placements": [ { "stage": "installation", "note": "Defensive support: process, service, and state-change analytics help investigate a foothold; validate required event fields and benign controls.", "read_sections": [] }, { "stage": "command-and-control", "note": "Defensive support: use network indicators, periodicity, and correlated events to test a C2 hypothesis, not infer a malware family from one alert.", "read_sections": [ "14. Suspicious DNS Query (Known C2 or Random Domain)" ] } ] }, { "id": "archive:2025/2025-12-02-correlation-based-detection-rules-in-cybersecurity-from-atomic-events-to-behavioral-insigh-1b3df31597bb", "title": "Correlation-Based Detection Rules in Cybersecurity: From Atomic Events to Behavioral Insight", "url": "https://1200km.com/articles/read/2025/2025-12-02-correlation-based-detection-rules-in-cybersecurity-from-atomic-events-to-behavioral-insigh-1b3df31597bb/", "kind": "authored", "source_path": "2025/2025-12-02-correlation-based-detection-rules-in-cybersecurity-from-atomic-events-to-behavioral-insigh-1b3df31597bb.md", "source_sha256": "aa0369423d9afcc90174e5e61eb4765cebbe90865a0c6ad2b38cf7597e4b70ea", "evidence_sections": [ "A comprehensive exploration of multi-event analytics, temporal logic, and rule chaining for advanced threat detection across modern SIEM and XDR ecosystems.", "Detection Techniques" ], "placements": [ { "stage": "installation", "note": "Defensive support: process, service, and state-change analytics help investigate a foothold; validate required event fields and benign controls.", "read_sections": [] }, { "stage": "command-and-control", "note": "Defensive support: use network indicators, periodicity, and correlated events to test a C2 hypothesis, not infer a malware family from one alert.", "read_sections": [] }, { "stage": "actions-on-objectives", "note": "Defensive support: connect data movement, identity abuse, and business impact to a tested detection or incident hypothesis.", "read_sections": [] } ] }, { "id": "archive:2025/2025-12-12-protocol-level-network-threat-hunting-a-wireshark-centric-guide-a6770ffc96c6", "title": "Protocol-Level Network Threat Hunting: A Wireshark-Centric Guide", "url": "https://1200km.com/articles/read/2025/2025-12-12-protocol-level-network-threat-hunting-a-wireshark-centric-guide-a6770ffc96c6/", "kind": "authored", "source_path": "2025/2025-12-12-protocol-level-network-threat-hunting-a-wireshark-centric-guide-a6770ffc96c6.md", "source_sha256": "1dcc60de825dafca0b3343ac311aa657a4e1f64d1e060a8155b205da87d05e93", "evidence_sections": [ "Uncovering Stealthy Attacks Through IOCs, Anomaly Detection, and Practical Playbooks", "Network IOC Classes", "Protocol-Specific Suspicious Behavior and Wireshark Detection Recipes", "Hunting Playbook: DNS-Tunnel Exfiltration" ], "placements": [ { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "HTTP / HTTPS / TLS", "Hunting Playbook: DNS-Tunnel Exfiltration" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Hunting Playbook: DNS-Tunnel Exfiltration" ] } ] }, { "id": "archive:2025/2025-12-14-endpoint-threat-hunting-proactive-detection-on-windows-linux-and-macos-f892d9b8a113", "title": "Endpoint Threat Hunting: Proactive Detection on Windows, Linux, and macOS", "url": "https://1200km.com/articles/read/2025/2025-12-14-endpoint-threat-hunting-proactive-detection-on-windows-linux-and-macos-f892d9b8a113/", "kind": "authored", "source_path": "2025/2025-12-14-endpoint-threat-hunting-proactive-detection-on-windows-linux-and-macos-f892d9b8a113.md", "source_sha256": "ec6b6a981895b330d0076d66cc425fbd69b58de7b5d9e069ec67d72cd3ebab2f", "evidence_sections": [ "Uncovering Advanced Compromises Through Telemetry, Artifacts, MITRE ATT&CK Tactics, and Practical Playbooks", "3. The Registry: Persistence and History", "Persistence Mechanisms", "Persistence: LaunchAgents & LaunchDaemons", "Network Connections", "Application Telemetry:", "Detection Playbooks and Queries" ], "placements": [ { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "3. The Registry: Persistence and History", "5. Scheduled Tasks" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Uncovering Advanced Compromises Through Telemetry, Artifacts, MITRE ATT&CK Tactics, and Practical Playbooks" ] } ] }, { "id": "archive:2025/2025-12-18-hexstrike-ai-install-configure-and-run-mcp-with-gemini-openai-cursor-llama-85a0e5752949", "title": "HexStrike AI: Install, Configure, and Run MCP with Gemini, OpenAI, Cursor, Llama", "url": "https://1200km.com/articles/read/2025/2025-12-18-hexstrike-ai-install-configure-and-run-mcp-with-gemini-openai-cursor-llama-85a0e5752949/", "kind": "authored", "source_path": "2025/2025-12-18-hexstrike-ai-install-configure-and-run-mcp-with-gemini-openai-cursor-llama-85a0e5752949.md", "source_sha256": "e3e381099db75ab4811d3e1602b28aae7a0317fa62731ee67fd042fc9ac3972b", "evidence_sections": [ "A practical, end-to-end guide to installing HexStrike AI, wiring it as an MCP server, and running real tool-driven workflows (recon → enumeration → validation) with Gemini, OpenAI, Cursor, and Llama.", "Installation Instructions", "Install Codex CLI on Ubuntu/Debian and connect to MCP HexStrike on Kali via ssh", "Install prerequisites (Node.js + npm)", "Install Codex CLI (global)", "Phase 1: Reconnaissance (Attack Surface Mapping)", "Phase 2: Vulnerability Discovery (The “Hit List”)", "Phase 3: Exploitation (Gaining Access)", "Phase 4: Post-Exploitation (Living off the Land)" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2025/2025-12-21-ai-driven-pentesting-at-home-using-hexstrike-ai-for-full-network-discovery-and-exploitatio-00a9e88b3bde", "title": "AI-Driven Pentesting at Home: Using HexStrike-AI for Full Network Discovery and Exploitation", "url": "https://1200km.com/articles/read/2025/2025-12-21-ai-driven-pentesting-at-home-using-hexstrike-ai-for-full-network-discovery-and-exploitatio-00a9e88b3bde/", "kind": "authored", "source_path": "2025/2025-12-21-ai-driven-pentesting-at-home-using-hexstrike-ai-for-full-network-discovery-and-exploitatio-00a9e88b3bde.md", "source_sha256": "a3adff66b7f3457dc90505bbcc7bd6859071f291f117d6b6c7b68325119a96aa", "evidence_sections": [ "How I Used Gemini + HexStrike-AI on Kali Linux to Scan, Enumerate, and Exploit My Own Network", "Install, configuration, and basic usage are covered in my guide here:", "Phase 1: Network Discovery", "Phase 2: Enumeration & Service Detection", "Phase 3: Vulnerability Discovery", "Phase 4: Controlled Exploitation" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "How I Used Gemini + HexStrike-AI on Kali Linux to Scan, Enumerate, and Exploit My Own Network", "Phase 2: Enumeration & Service Detection" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "How I Used Gemini + HexStrike-AI on Kali Linux to Scan, Enumerate, and Exploit My Own Network", "Phase 3: Vulnerability Discovery" ] } ] }, { "id": "archive:2025/2025-12-22-ai-driven-web-application-pentesting-with-hexstrike-ai-67f3dae32040", "title": "AI-Driven Web Application Pentesting with HexStrike-AI", "url": "https://1200km.com/articles/read/2025/2025-12-22-ai-driven-web-application-pentesting-with-hexstrike-ai-67f3dae32040/", "kind": "authored", "source_path": "2025/2025-12-22-ai-driven-web-application-pentesting-with-hexstrike-ai-67f3dae32040.md", "source_sha256": "ffd39cadf6ba7e327bc60022f4bd4eb97405f45980bcf38aa1e03dd6a931e752", "evidence_sections": [ "Payload Example", "Step 7: Exploitation Summary", "Step 8: Sample Exploitation Flow" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "What HexStrike Executes", "Step 7: Exploitation Summary" ] } ] }, { "id": "archive:2025/2025-12-23-integrating-shodan-with-hexstrike-ai-using-gemini-cli-b6f9fcbe8e6e", "title": "Integrating Shodan with HexStrike-AI Using Gemini-CLI", "url": "https://1200km.com/articles/read/2025/2025-12-23-integrating-shodan-with-hexstrike-ai-using-gemini-cli-b6f9fcbe8e6e/", "kind": "authored", "source_path": "2025/2025-12-23-integrating-shodan-with-hexstrike-ai-using-gemini-cli-b6f9fcbe8e6e.md", "source_sha256": "9f5546d21e0085edf1732dcb01e76e7cdee796c4b83adf990a127f28552a2bc2", "evidence_sections": [ "A Practical Guide to AI-Driven External Reconnaissance and Vulnerability Analysis", "2. Network & service discovery", "5. Information disclosure via ONVIF (core vulnerability)", "Confirmed Vulnerabilities", "1. Default Credentials (High)" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "A Practical Guide to AI-Driven External Reconnaissance and Vulnerability Analysis", "3. Internet Exposure (High)" ] } ] }, { "id": "archive:2025/2025-12-24-ai-driven-wireless-penetration-testing-one-promt-wifi-cracking-6477c06f6af4", "title": "AI-Driven Wireless Penetration Testing. One Promt WIFI cracking", "url": "https://1200km.com/articles/read/2025/2025-12-24-ai-driven-wireless-penetration-testing-one-promt-wifi-cracking-6477c06f6af4/", "kind": "authored", "source_path": "2025/2025-12-24-ai-driven-wireless-penetration-testing-one-promt-wifi-cracking-6477c06f6af4.md", "source_sha256": "57ddb8244e30e4189199e71f5057783d51b70d7c2aa636e7b4a1e133a2404716", "evidence_sections": [ "3. Initial wireless scan", "This was not a single-command crack — it was a full, adaptive PT flow ." ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "archive:2025/2025-12-25-ai-driven-zip-password-recovery-with-hexstrike-ai-and-gemini-cli-b8fc5c475ebc", "title": "AI-Driven ZIP Password Recovery with HexStrike-AI and Gemini-CLI", "url": "https://1200km.com/articles/read/2025/2025-12-25-ai-driven-zip-password-recovery-with-hexstrike-ai-and-gemini-cli-b8fc5c475ebc/", "kind": "authored", "source_path": "2025/2025-12-25-ai-driven-zip-password-recovery-with-hexstrike-ai-and-gemini-cli-b8fc5c475ebc.md", "source_sha256": "50c3c84c719a96423ed778edebca53815ed7030e80cdd5a8af4e5bea01c15eaf", "evidence_sections": [ "From Encrypted Archive to Flag Using LLM-Orchestrated Tooling" ], "placements": [ { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "From Encrypted Archive to Flag Using LLM-Orchestrated Tooling", "4. Offline password cracking" ] } ] }, { "id": "archive:2025/2025-12-25-hexstrike-ai-a-force-multiplier-for-red-teams-and-a-dangerous-shift-in-the-threat-landscap-3e1d4e86f3ae", "title": "HexStrike-AI: A Force Multiplier for Red Teams — and a Dangerous Shift in the Threat Landscape", "url": "https://1200km.com/articles/read/2025/2025-12-25-hexstrike-ai-a-force-multiplier-for-red-teams-and-a-dangerous-shift-in-the-threat-landscap-3e1d4e86f3ae/", "kind": "authored", "source_path": "2025/2025-12-25-hexstrike-ai-a-force-multiplier-for-red-teams-and-a-dangerous-shift-in-the-threat-landscap-3e1d4e86f3ae.md", "source_sha256": "775520e84a36c81b4537d674984b5ad022a2adc17bef918a23f1dec7e1cbe4fb", "evidence_sections": [ "Example: Full Network Pentesting at Home" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2025/2025-12-26-hexstrike-gemini-vs-hackerai-ops-copilot-vs-chatbot-with-tools-1d799845410b", "title": "HexStrike + Gemini vs. HackerAI: “Ops Copilot” vs. “Chatbot with Tools”", "url": "https://1200km.com/articles/read/2025/2025-12-26-hexstrike-gemini-vs-hackerai-ops-copilot-vs-chatbot-with-tools-1d799845410b/", "kind": "authored", "source_path": "2025/2025-12-26-hexstrike-gemini-vs-hackerai-ops-copilot-vs-chatbot-with-tools-1d799845410b.md", "source_sha256": "fe4a1226ca8a36b143a3e55b9a29237ebe8daef3b61ad973f5aab051a7f9cb6e", "evidence_sections": [ "The Shift: Impact on the Threat Landscape" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2025/2025-12-29-ai-driven-office-documents-password-recovery-with-hexstrike-ai-and-gemini-cli-3c8bb7deb82d", "title": "AI-Driven Office Documents Password Recovery with HexStrike-AI and Gemini-CLI", "url": "https://1200km.com/articles/read/2025/2025-12-29-ai-driven-office-documents-password-recovery-with-hexstrike-ai-and-gemini-cli-3c8bb7deb82d/", "kind": "authored", "source_path": "2025/2025-12-29-ai-driven-office-documents-password-recovery-with-hexstrike-ai-and-gemini-cli-3c8bb7deb82d.md", "source_sha256": "6b8e15e07f1859286855f27cac165f8addd59b29a6be5b909427d467863732c3", "evidence_sections": [ "From Encrypted Document to Readable Content Using LLM-Orchestrated Tooling" ], "placements": [ { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "From Encrypted Document to Readable Content Using LLM-Orchestrated Tooling", "Objective" ] } ] }, { "id": "archive:2025/2025-12-29-ai-driven-pdf-password-recovery-with-hexstrike-ai-and-gemini-cli-cfa7eb0fae91", "title": "AI-Driven PDF Password Recovery with HexStrike-AI and Gemini-CLI", "url": "https://1200km.com/articles/read/2025/2025-12-29-ai-driven-pdf-password-recovery-with-hexstrike-ai-and-gemini-cli-cfa7eb0fae91/", "kind": "authored", "source_path": "2025/2025-12-29-ai-driven-pdf-password-recovery-with-hexstrike-ai-and-gemini-cli-cfa7eb0fae91.md", "source_sha256": "62dfe973bd89f57febcde9750e0d9bf2116169855149954460145b480402d9f4", "evidence_sections": [ "From Encrypted Document to Readable Content Using LLM-Orchestrated Tooling" ], "placements": [ { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "From Encrypted Document to Readable Content Using LLM-Orchestrated Tooling", "Objective" ] } ] }, { "id": "archive:2025/2025-12-31-hexstrike-mcp-orchestration-with-ollama-ubuntu-host-kali-vm-ssh-bridging-and-performance-f049ab140596", "title": "HexStrike MCP Orchestration with Ollama: Ubuntu Host, Kali VM, SSH Bridging, and Performance…", "url": "https://1200km.com/articles/read/2025/2025-12-31-hexstrike-mcp-orchestration-with-ollama-ubuntu-host-kali-vm-ssh-bridging-and-performance-f049ab140596/", "kind": "authored", "source_path": "2025/2025-12-31-hexstrike-mcp-orchestration-with-ollama-ubuntu-host-kali-vm-ssh-bridging-and-performance-f049ab140596.md", "source_sha256": "14a280494b1c8718f75fb40b0f8fc8cd600df4d2df4157f983fb71ab3624dcb6", "evidence_sections": [ "2) Ubuntu (host): install Ollama + pull a model", "2.1 Install Ollama", "3) Kali VM: install and start HexStrike", "3.1 Install", "4) Kali VM — Networking + SSH (so Ubuntu can run HexStrike tools inside Kali)", "4.1 VM networking recommendation", "5) Host (Ubuntu) — Install mcphost (terminal MCP host) and wire it to HexStrike", "5.1 Install Go + mcphost", "9) Recommended hardening (do this)", "9.1 Do not expose HexStrike API on the network" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-01-02-burp-suite-mcp-gemini-cli-c1229edfe092", "title": "Burp Suite MCP + Gemini CLI", "url": "https://1200km.com/articles/read/2026/2026-01-02-burp-suite-mcp-gemini-cli-c1229edfe092/", "kind": "authored", "source_path": "2026/2026-01-02-burp-suite-mcp-gemini-cli-c1229edfe092.md", "source_sha256": "1fad455b3365790a28d3caba4e04efe21c2dd5f49a5251d6e11781aaa889edb0", "evidence_sections": [ "Connect Burp Suite to Gemini CLI using Model Context Protocol (MCP) and Turn Burp into an AI-callable toolset and accelerate recon, analysis, and reporting in authorized tests.", "3) Install the Burp MCP Server extension", "Option A (recommended): Install from Burp BApp Store", "Workspace/file-write constraint (impacted reporting/automation)", "13) Hardening recommendations" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "6) Validate the connection", "Finding 1 — Remote Code Execution via insecure upload handling (Critical)" ] } ] }, { "id": "archive:2026/2026-01-03-hexstrike-openai-codex-ai-driven-exploitation-of-metasploitable-b892c07be39f", "title": "HexStrike+OpenAI Codex. AI-Driven Exploitation of Metasploitable.", "url": "https://1200km.com/articles/read/2026/2026-01-03-hexstrike-openai-codex-ai-driven-exploitation-of-metasploitable-b892c07be39f/", "kind": "authored", "source_path": "2026/2026-01-03-hexstrike-openai-codex-ai-driven-exploitation-of-metasploitable-b892c07be39f.md", "source_sha256": "e6365e7b97f3582b84ff6b4f29c0d7206a6d42cc3749e2df05985b01204223a6", "evidence_sections": [ "How I Used an LLM-Orchestrated Toolchain to Enumerate and Exploit a Deliberately Vulnerable Host (With Real Proofs)", "Phase 3: Vulnerability Discovery (What Stood Out Immediately)", "Phase 4: Exploitation (With Proofs)", "Exploit #1 — vsftpd 2.3.4 backdoor (CVE-2011–2523) → Root", "Exploit #2 — Samba usermap_script (CVE-2007–2447) → Root bind shell", "Step A — Launch exploit with bind netcat payload (binds on port 4446)" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Phase 3: Vulnerability Discovery (What Stood Out Immediately)", "Phase 4: Exploitation (With Proofs)" ] } ] }, { "id": "archive:2026/2026-01-04-hexstrike-gemini-ai-assisted-ssh-credential-brute-force-a9162f8e253b", "title": "HexStrike + Gemini. AI-Assisted SSH Credential Brute-Force", "url": "https://1200km.com/articles/read/2026/2026-01-04-hexstrike-gemini-ai-assisted-ssh-credential-brute-force-a9162f8e253b/", "kind": "authored", "source_path": "2026/2026-01-04-hexstrike-gemini-ai-assisted-ssh-credential-brute-force-a9162f8e253b.md", "source_sha256": "ebb039b6745e2ace1c708d07efef69da9f254c198a892f5327c1a57e65e564b9", "evidence_sections": [ "2) Port scanning", "3) Custom small lists succeeded (and exposed weak credentials)", "Detection and hardening checklist (what to do next)", "Hardening (highest ROI first)", "Detection engineering" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "From Service Validation → Dependency Fixes → Findings → Defensive Takeaways", "Step-by-step execution flow" ] } ] }, { "id": "archive:2026/2026-01-05-building-an-extremely-vulnerable-windows-10-lab-a-step-by-step-guide-bonus-full-pt-with-9290d388744c", "title": "Building an Extremely Vulnerable Windows 10 Lab: A Step-by-Step Guide (Bonus:Full PT with…", "url": "https://1200km.com/articles/read/2026/2026-01-05-building-an-extremely-vulnerable-windows-10-lab-a-step-by-step-guide-bonus-full-pt-with-9290d388744c/", "kind": "authored", "source_path": "2026/2026-01-05-building-an-extremely-vulnerable-windows-10-lab-a-step-by-step-guide-bonus-full-pt-with-9290d388744c.md", "source_sha256": "0e3c6fcdafcee067355987739f1d46ac42cfe80c37d3679eae9c53bc298e1856", "evidence_sections": [ "Building an Extremely Vulnerable Windows 10 Lab: A Step-by-Step Guide (Bonus:Full PT with Hexstrike)", "Install Windows 10 in the VirtualBox", "Step 2: Install Windows 10 in VMware Workstation 17", "Install VMware Tools (Equivalent to Guest Additions — Critical for Performance)", "Step 3: Configure Basic Networking and Access", "Step 4: Introduce Vulnerabilities Using PowerShell Script", "Explanation of Introduced Vulnerabilities (Updated for v9.0 Script)", "2. Open and Vulnerable Services", "6. Additional Kernel/System Vulnerabilities" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Building an Extremely Vulnerable Windows 10 Lab: A Step-by-Step Guide (Bonus:Full PT with Hexstrike)", "Step 3: Configure Basic Networking and Access" ] } ] }, { "id": "archive:2026/2026-01-05-hexstrike-gemini-ai-assisted-smb-exposure-credential-brute-force-2c5f99dcdbf4", "title": "HexStrike + Gemini. AI-Assisted SMB Exposure Credential Brute-Force", "url": "https://1200km.com/articles/read/2026/2026-01-05-hexstrike-gemini-ai-assisted-smb-exposure-credential-brute-force-2c5f99dcdbf4/", "kind": "authored", "source_path": "2026/2026-01-05-hexstrike-gemini-ai-assisted-smb-exposure-credential-brute-force-2c5f99dcdbf4.md", "source_sha256": "0dce945825258dd01030ddf8194d2b5a0090ddd158c0eb4db52ef933f58215a2", "evidence_sections": [ "1) Fast scan failed → fallback to a full Nmap fingerprint", "6) Credential hygiene test succeeded (but reveals systemic weakness)", "1) Fix protocol posture (high impact)", "3) Repair identity controls", "5) Keep the good part: network logon restrictions", "Detection engineering (what to monitor)", "Network telemetry" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Execution flow (what actually happened)", "6) Credential hygiene test succeeded (but reveals systemic weakness)" ] } ] }, { "id": "archive:2026/2026-01-06-building-an-extremely-vulnerable-ubuntu-24-04-server-lab-bonus-full-pt-with-hexstrike-90034032775b", "title": "Building an Extremely Vulnerable Ubuntu 24.04 Server Lab (Bonus: Full PT with Hexstrike)", "url": "https://1200km.com/articles/read/2026/2026-01-06-building-an-extremely-vulnerable-ubuntu-24-04-server-lab-bonus-full-pt-with-hexstrike-90034032775b/", "kind": "authored", "source_path": "2026/2026-01-06-building-an-extremely-vulnerable-ubuntu-24-04-server-lab-bonus-full-pt-with-hexstrike-90034032775b.md", "source_sha256": "02b7e89aeb2612893bf6254a9aed7f4660d14312bc3d0d235a4ca4f2c7aabe4d", "evidence_sections": [ "A Step-by-Step Guide: Hands-on guide to creating an intentionally insecure Ubuntu 24.04.3 Server VM with open SSH, FTP, Samba, NFS, Apache/PHP, MariaDB, privilege escalation vectors, vulnerable web apps, and sensitive data leaks", "Step 3: Install Ubuntu 24.04.3 Server", "Step 4: Configure Basic Networking and Access", "Step 5: Introduce Vulnerabilities Using Bash Script", "3. Reconnaissance - Open Ports and Protocols", "4. Vulnerabilities and Exploits", "4.2. Critical: Exposed Credentials (passwords.txt)", "4.3. High: phpMyAdmin Access with Root Credentials", "5. Sensitive Files and Credentials Found", "8.2. Immediate Action: Remove Exposed Credentials" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Step 4: Configure Basic Networking and Access", "Step 5: Introduce Vulnerabilities Using Bash Script" ] } ] }, { "id": "archive:2026/2026-01-08-hexstrike-cursor-mcp-from-single-target-full-subnet-compromise-lab-pt-walkthrough-f2e1fd793ad7", "title": "HexStrike + Cursor (MCP): From Single Target → Full Subnet Compromise (Lab PT Walkthrough)", "url": "https://1200km.com/articles/read/2026/2026-01-08-hexstrike-cursor-mcp-from-single-target-full-subnet-compromise-lab-pt-walkthrough-f2e1fd793ad7/", "kind": "authored", "source_path": "2026/2026-01-08-hexstrike-cursor-mcp-from-single-target-full-subnet-compromise-lab-pt-walkthrough-f2e1fd793ad7.md", "source_sha256": "9f22a4058b949226988949ca497e32670bd687ed39641c78a1e166a9b9963dde", "evidence_sections": [ "A real end-to-end lab engagement: recon → credential discovery → share abuse → lateral movement → multi-host compromise → reporting" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Scenario and objective" ] } ] }, { "id": "archive:2026/2026-01-11-hexstrike-cursor-for-osint-from-one-email-to-a-full-exposure-map-ffdfc7ba1b30", "title": "HexStrike + Cursor for OSINT: From One Email to a Full Exposure Map", "url": "https://1200km.com/articles/read/2026/2026-01-11-hexstrike-cursor-for-osint-from-one-email-to-a-full-exposure-map-ffdfc7ba1b30/", "kind": "authored", "source_path": "2026/2026-01-11-hexstrike-cursor-for-osint-from-one-email-to-a-full-exposure-map-ffdfc7ba1b30.md", "source_sha256": "426499da9bed55c9b3160d077261d806299961ab1c8bdc82be318ebb39b6f99f", "evidence_sections": [ "3.4 Logging controls", "Finding 3 — Credential exposure checks Result summary (public-safe):" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "5) Real report (PUBLIC / REDACTED): Exposure & Correlation Report", "Data Breach Exposure" ] } ] }, { "id": "archive:2026/2026-01-15-building-a-usb-rubber-ducky-with-arduino-leonardo-with-cursor-a23dd64d1bbe", "title": "Building a USB Rubber Ducky with Arduino Leonardo with Cursor.", "url": "https://1200km.com/articles/read/2026/2026-01-15-building-a-usb-rubber-ducky-with-arduino-leonardo-with-cursor-a23dd64d1bbe/", "kind": "authored", "source_path": "2026/2026-01-15-building-a-usb-rubber-ducky-with-arduino-leonardo-with-cursor-a23dd64d1bbe.md", "source_sha256": "b7b59fb2280c233a4acba8d88fb7be213901a5b302724b56ace7e3379afd9010", "evidence_sections": [ "Commands Executed", "Phase 2: Device Detection and IDE Integration", "Phase 4: Rubber Ducky Payload Development", "Commands Executed", "✅ Rubber Ducky payload successfully created and uploaded!" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Phase 4: Rubber Ducky Payload Development", "✅ Rubber Ducky payload successfully created and uploaded!" ] }, { "stage": "delivery", "note": "HID/USB delivery context: a programmable keyboard reaches the target through physical device interaction.", "read_sections": [ "What is a USB Rubber Ducky?" ] } ] }, { "id": "archive:2026/2026-01-16-hacker-tool-development-workflow-android-rubber-ducky-payloads-in-cursor-ai-47fcccb9c845", "title": "Hacker Tool Development Workflow: Android Rubber Ducky Payloads in Cursor AI", "url": "https://1200km.com/articles/read/2026/2026-01-16-hacker-tool-development-workflow-android-rubber-ducky-payloads-in-cursor-ai-47fcccb9c845/", "kind": "authored", "source_path": "2026/2026-01-16-hacker-tool-development-workflow-android-rubber-ducky-payloads-in-cursor-ai-47fcccb9c845.md", "source_sha256": "f933516bdb5c24e74faf388aba01f8e0148809d8b9cc2c9139ba25fcdec819a6", "evidence_sections": [ "From plain-English prompts to reliable HID flows — validated with emulator screenshots and telemetry", "Failure Detection" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [] }, { "stage": "delivery", "note": "Android HID workflow illustrates physical input delivery and emulator validation, not an observed intrusion.", "read_sections": [ "From plain-English prompts to reliable HID flows — validated with emulator screenshots and telemetry" ] } ] }, { "id": "archive:2026/2026-01-17-the-one-prompt-pt-lab-autonomous-android-security-research-with-cursor-ai-b96ed2053071", "title": "The One-Prompt PT Lab: Autonomous Android Security Research with Cursor AI", "url": "https://1200km.com/articles/read/2026/2026-01-17-the-one-prompt-pt-lab-autonomous-android-security-research-with-cursor-ai-b96ed2053071/", "kind": "authored", "source_path": "2026/2026-01-17-the-one-prompt-pt-lab-autonomous-android-security-research-with-cursor-ai-b96ed2053071.md", "source_sha256": "df3c5647c7e7ab1c861f5524afd5877f9fdac48dcbdac5fe245c2434712675e1", "evidence_sections": [ "From Bare Directory to Full Exploitation: A Case Study on OWASP UnCrackable L1", "2. Target Acquisition & Static Analysis", "3. Exploitation & Proof of Concept (PoC)", "1.3 Install System Dependencies", "Step 2: Install Security Tools", "Step 3: Download Vulnerable App", "Static Analysis", "Vulnerability Discovery", "Vulnerability 1: Hardcoded Encryption Key and Secret", "Vulnerability 2: Weak Encryption Implementation", "Vulnerability 3: Root Detection Bypass", "Vulnerability 4: Debug Detection Bypass", "Vulnerability 5: Insufficient Code Obfuscation", "Exploit Development", "Exploit 1: Secret Decryption Script", "Exploit 2: Frida Root Detection Bypass", "Exploit 3: Runtime Decryption Hook", "Step 1: Install APK on Emulator" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "From Bare Directory to Full Exploitation: A Case Study on OWASP UnCrackable L1", "The “One Prompt” Execution Flow" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Objectives", "3.1 Search for Hardcoded Secrets" ] } ] }, { "id": "archive:2026/2026-01-19-the-ai-revolution-in-offensive-security-31e44704d51a", "title": "The AI Revolution in Offensive Security", "url": "https://1200km.com/articles/read/2026/2026-01-19-the-ai-revolution-in-offensive-security-31e44704d51a/", "kind": "authored", "source_path": "2026/2026-01-19-the-ai-revolution-in-offensive-security-31e44704d51a.md", "source_sha256": "fc342b5755a138520c8b4985bcd1e6940cc897a670b67ae29928104e27b36608", "evidence_sections": [ "Practical Hands-On Guide to AI-Accelerated Offensive Security: Burp Suite, Nmap, OSINT, Exploitation, and End-to-End Automation (LLMs + MCP, Cursor, HexStrike-AI)", "Reinventing Recon: Nmap Meets ChatGPT", "AI-Driven Network Penetration Testing", "Fully Automated AD Discovery and Exploitation with Cursor AI and HexStrike-ai MCP. From IP to Full dump.", "Credential Brute-Forcing with AI Assistance", "SMB Credential Attacks", "SSH Credential Attacks", "Exploitation with AI Code Generation", "A Complete Guide to Modern AI-Powered Security Testing. From One Prompt to Full Attack Surface Coverage (Recon → Exploit → Report).", "Impact to Blue Teams. The Threat Curve Just Bent Upwards", "Lower Skill, Higher Impact", "Installation and Configuration Guides", "The Broader Impact: AI as a Strategic Enabler" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-01-23-deploy-a-complete-active-directory-pentest-lab-in-one-prompt-with-cursor-ai-ff926fd2b3fc", "title": "Deploy a Complete Active Directory PenTest Lab in One Prompt with Cursor AI", "url": "https://1200km.com/articles/read/2026/2026-01-23-deploy-a-complete-active-directory-pentest-lab-in-one-prompt-with-cursor-ai-ff926fd2b3fc/", "kind": "authored", "source_path": "2026/2026-01-23-deploy-a-complete-active-directory-pentest-lab-in-one-prompt-with-cursor-ai-ff926fd2b3fc.md", "source_sha256": "09a3fb3696ab859ef2f618b3cdc9c5029724ff98eff66ead1f291327d4a37bd2", "evidence_sections": [ "Installation Commands", "Network Configuration", "Step 6: Wait for VM Readiness (with Smart Port Detection)", "State Persistence", "Resume Command", "Network Auto-Detection", "Network Architecture", "Access Credentials", "Verification Commands" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Step 8: Generate Deployment Proofs (with Validation)", "Access Credentials" ] } ] }, { "id": "archive:2026/2026-01-24-active-directory-lab-for-pentest-manual-deployment-guide-cab28cd4ad8d", "title": "Active Directory Lab for PenTest. Manual Deployment Guide", "url": "https://1200km.com/articles/read/2026/2026-01-24-active-directory-lab-for-pentest-manual-deployment-guide-cab28cd4ad8d/", "kind": "authored", "source_path": "2026/2026-01-24-active-directory-lab-for-pentest-manual-deployment-guide-cab28cd4ad8d.md", "source_sha256": "bbaf20da60343957615c886af1bdb943d518baaa6557213d532da0dc350eee19", "evidence_sections": [ "This guide is a manual, step-by-step deployment of a GOAD-Mini Active Directory environment on VirtualBox/VagrantComplete Step-by-Step Guide with DFIR Logging and Vulnerabilities", "GOAD-Mini AD Sanity Check (Domain Controller)", "Comprehensive DFIR logging baseline for a Domain Controller (GOAD/GOAD-Mini)", "Vulnerability Configuration", "Create Vulnerability Configuration Script", "This guide provides a comprehensive framework for deploying GOAD-Mini (Game of Active Directory) with advanced DFIR (Digital Forensics and Incident Response) logging and intentional vulnerabilities." ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Vulnerability Configuration", "Create Vulnerability Configuration Script" ] } ] }, { "id": "archive:2026/2026-01-26-active-directory-penetration-testing-745cfb31d7d3", "title": "Active Directory Penetration Testing", "url": "https://1200km.com/articles/read/2026/2026-01-26-active-directory-penetration-testing-745cfb31d7d3/", "kind": "authored", "source_path": "2026/2026-01-26-active-directory-penetration-testing-745cfb31d7d3.md", "source_sha256": "0fe96179ca3fe204731f7ed85d8122b673a535b3eb3c7c13c8a2750a8baedbb1", "evidence_sections": [ "Phase 1: Reconnaissance and Network Discovery", "Initial Reconnaissance", "Network Scanning", "Service Version Detection", "Phase 4: Password Discovery and Credential", "Strategy: Gaining Valid Credentials", "Next Steps After Finding Credentials", "Credential Discovery Results", "Strategy: Deep Enumeration with Valid Credentials", "Phase 5: Advanced Exploitation", "Findings and Vulnerabilities", "F-01: Known / Weak Domain Administrator Credential", "F-02: Excessive Privilege Enables Domain-Wide Credential Disclosure", "F-06: Exposed HTTP Service on Domain Controller", "Positive Security Controls Observed", "Monitoring and Alerting (Detection Engineering)", "Endpoint & Credential Protections (Where Applicable)" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Phase 1: Reconnaissance and Network Discovery", "Initial Reconnaissance" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Phase 4: Password Discovery and Credential", "Strategy: Gaining Valid Credentials" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Objectives", "Phase 4: Password Discovery and Credential" ] } ] }, { "id": "archive:2026/2026-01-27-ai-driven-black-box-active-directory-penetration-testing-8de0b9ad38b7", "title": "AI-Driven Black Box Active Directory Penetration Testing", "url": "https://1200km.com/articles/read/2026/2026-01-27-ai-driven-black-box-active-directory-penetration-testing-8de0b9ad38b7/", "kind": "authored", "source_path": "2026/2026-01-27-ai-driven-black-box-active-directory-penetration-testing-8de0b9ad38b7.md", "source_sha256": "6d807c6926620ad803a1cc289b0e92755c7df5a541382e293c2f294a4aafcb6b", "evidence_sections": [ "Fully Automated AD Discovery and Exploitation with Cursor AI and HexStrike-ai MCP. From IP to Full dump.", "Phase 1: Network Discovery", "Phase 4: Credential Discovery", "Phase 6: Advanced Exploitation", "Valid Credentials", "Vulnerabilities Identified", "Exploits Executed" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Phase 2: Active Directory Discovery via SMB Enumeration", "Phase 3: User Enumeration" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Fully Automated AD Discovery and Exploitation with Cursor AI and HexStrike-ai MCP. From IP to Full dump", "Phase 4: Credential Discovery" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Phase 4: Credential Discovery", "Password Spraying" ] } ] }, { "id": "archive:2026/2026-01-28-adcs-esc8-attack-certificate-based-domain-compromise-complete-guide-7ec76562fa6d", "title": "ADCS ESC8 Attack: Certificate-Based Domain Compromise — Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-01-28-adcs-esc8-attack-certificate-based-domain-compromise-complete-guide-7ec76562fa6d/", "kind": "authored", "source_path": "2026/2026-01-28-adcs-esc8-attack-certificate-based-domain-compromise-complete-guide-7ec76562fa6d.md", "source_sha256": "ea63fa066af5ab8dd3dac68725e65fa95e47f0e811dcc91cc099b003da1a10c1", "evidence_sections": [ "Understanding the Vulnerability", "5. Real-World Impact", "Scenario 2: Network Access but No Valid Credentials", "Scenario 3: Bypassing Account Security Controls", "Phase 0: Obtaining Low-Privilege Credentials", "Overview: The Credential Discovery Process", "Step 0.1: Initial Reconnaissance — Port Scanning", "Step 0.3: Enumerate Domain Users (Without Credentials)", "Step 0.5: Verify Credentials", "Summary: Credential Discovery Workflow", "Phase 1: Reconnaissance and Enumeration", "Step 2.1: Request Certificate Using Low-Privilege Credentials", "1. Network Segmentation", "3. Access Controls", "Detection and Monitoring", "Detection Queries", "PowerShell Detection Script" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Step 0.1: Initial Reconnaissance — Port Scanning", "User Enumeration Techniques" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Understanding the Vulnerability", "Scenario 1: Initial Access with Low Privileges" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "5. Real-World Impact", "Scenario 2: Network Access but No Valid Credentials" ] } ] }, { "id": "archive:2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff", "title": "Building a Vulnerable GCP Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff/", "kind": "authored", "source_path": "2026/2026-01-29-building-a-vulnerable-gcp-pentest-lab-with-terraform-9d1edfcd8eff.md", "source_sha256": "a46d976f595000c33fbf23ac1c525900a05f536abc3e551b91f3646a18f84ef6", "evidence_sections": [ "Step 3: Authenticate and Set Up Application Default Credentials", "Step 3.2: Set Up Application Default Credentials (Required for Terraform)", "Step 3.3: Verify Application Default Credentials", "Troubleshooting Application Default Credentials", "DVWA (Damn Vulnerable Web Application) Deployment", "Step 2: Verify DVWA Installation", "Step 6: Verify Network Configuration", "DVWA (Damn Vulnerable Web Application)", "DVWA Vulnerability Categories" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Step 3: Authenticate and Set Up Application Default Credentials", "Step 3.2: Set Up Application Default Credentials (Required for Terraform)" ] } ] }, { "id": "archive:2026/2026-01-29-cursor-hexstrike-fully-automated-adcs-esc8-attack-8736fec53c58", "title": "Cursor + Hexstrike. Fully Automated ADCS ESC8 Attack", "url": "https://1200km.com/articles/read/2026/2026-01-29-cursor-hexstrike-fully-automated-adcs-esc8-attack-8736fec53c58/", "kind": "authored", "source_path": "2026/2026-01-29-cursor-hexstrike-fully-automated-adcs-esc8-attack-8736fec53c58.md", "source_sha256": "0e562a82caa7aa9a827b94487241cdc548ba0d64085de06c28475cba50ad799a", "evidence_sections": [ "Phase 1: Reconnaissance", "Phase 2: Credential Acquisition", "Detection and Monitoring", "Detection Queries" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Phase-by-Phase Execution", "Phase 2: Credential Acquisition" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "One-Prompt Domain Compromise", "Phase 2: Credential Acquisition" ] } ] }, { "id": "archive:2026/2026-01-31-a-complete-cloud-penetration-testing-walkthrough-1914f687d7fd", "title": "A Complete Cloud Penetration Testing Walkthrough", "url": "https://1200km.com/articles/read/2026/2026-01-31-a-complete-cloud-penetration-testing-walkthrough-1914f687d7fd/", "kind": "authored", "source_path": "2026/2026-01-31-a-complete-cloud-penetration-testing-walkthrough-1914f687d7fd.md", "source_sha256": "ed997a905b4e6e50cd3e200264d53f3d9e61076aa940b63927fd980a9de7e2b3", "evidence_sections": [ "How I Discovered Critical Vulnerabilities in a Cloud Environment Using Basic Tools and Methodical Testing", "Phase 1: Initial Reconnaissance — Mapping the Attack Surface", "Port Scanning: Finding Open Doors", "Testing Command Injection", "Phase 5: Cloud Function Exploitation — Gaining Cloud Access", "Phase 6: Storage Bucket Exploitation — The Treasure Trove" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Phase 1: Initial Reconnaissance — Mapping the Attack Surface", "Port Scanning: Finding Open Doors" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "How I Discovered Critical Vulnerabilities in a Cloud Environment Using Basic Tools and Methodical Testing", "Testing Command Injection" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Exposing Environment Variables and Secrets" ] } ] }, { "id": "archive:2026/2026-01-31-ai-assisted-web-and-cloud-penetration-testing-with-cursor-mcp-hexstrike-and-burp-suite-mcp-01c02eed5258", "title": "AI-Assisted Web and Cloud Penetration Testing with Cursor + MCP HexStrike and Burp Suite MCP.", "url": "https://1200km.com/articles/read/2026/2026-01-31-ai-assisted-web-and-cloud-penetration-testing-with-cursor-mcp-hexstrike-and-burp-suite-mcp-01c02eed5258/", "kind": "authored", "source_path": "2026/2026-01-31-ai-assisted-web-and-cloud-penetration-testing-with-cursor-mcp-hexstrike-and-burp-suite-mcp-01c02eed5258.md", "source_sha256": "6754fcb2ce1bfc4a854ffa7c75bbd5be6e7019f503e75574360538f770721674", "evidence_sections": [ "A Complete Guide to Modern AI-Powered Security Testing. From One Prompt to Full Attack Surface Coverage (Recon → Exploit → Report).", "Step 1: Install Cursor AI", "First Tool Selection: HexStrike MCP or Direct Command?", "GCP Metadata Access: Complex Command Execution", "2. Critical Vulnerabilities", "2.1 Command Injection in Cloud Function (CRITICAL)", "Vulnerable Code", "Impact", "Vulnerable Code", "Impact", "Impact", "Impact", "3. High Severity Vulnerabilities", "Impact", "Impact", "Impact", "4. Medium Severity Vulnerabilities", "5.2 Internal Network Information" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Web Application Enumeration: Choosing the Right Approach", "Cloud Enumeration: Using GCP APIs" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "GCP Metadata Access: Complex Command Execution", "Executive Summary" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "GCP Metadata Access: Complex Command Execution", "2.4 Environment Variables and Secrets Exposure (CRITICAL)" ] } ] }, { "id": "archive:2026/2026-02-02-building-a-vulnerable-kubernetes-lab-a-complete-guide-to-25-critical-security-issues-fae4fc8e3a91", "title": "Building a Vulnerable Kubernetes Lab: A Complete Guide to 25 Critical Security Issues", "url": "https://1200km.com/articles/read/2026/2026-02-02-building-a-vulnerable-kubernetes-lab-a-complete-guide-to-25-critical-security-issues-fae4fc8e3a91/", "kind": "authored", "source_path": "2026/2026-02-02-building-a-vulnerable-kubernetes-lab-a-complete-guide-to-25-critical-security-issues-fae4fc8e3a91.md", "source_sha256": "c41af22f5426924a148568b39d957bf095d366ac81de88379f24b48059bb4e0c", "evidence_sections": [ "Learn Kubernetes security by building a comprehensive penetration testing lab with 25 real-world vulnerabilities", "Quick Reference: Installation Commands", "Installing Required Tools", "1. Install Docker", "2. Install kubectl", "3. Install Kubernetes Cluster Tool", "Option B: Install Minikube (v1.0.0+)", "Verify All Installations", "Quick Installation Script", "Step 3: Build Vulnerable Application #1 (SQL Injection)", "Step 4: Build Vulnerable Application #2 (Command Injection)", "Step 5: Build Vulnerable Application #3 (K8S Token Exposure)", "Vulnerable RBAC Configuration", "Deploying all vulnerabilities", "Port Scan Verification", "Kubernetes Vulnerabilities Summary", "Vulnerability Categories", "Access Control (7)" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Step 3: Build Vulnerable Application #1 (SQL Injection)", "Step 4: Build Vulnerable Application #2 (Command Injection)" ] } ] }, { "id": "archive:2026/2026-02-03-black-box-kubernetes-penetration-testing-playbook-56350b178af4", "title": "Black-Box Kubernetes Penetration Testing Playbook", "url": "https://1200km.com/articles/read/2026/2026-02-03-black-box-kubernetes-penetration-testing-playbook-56350b178af4/", "kind": "authored", "source_path": "2026/2026-02-03-black-box-kubernetes-penetration-testing-playbook-56350b178af4.md", "source_sha256": "5c2752c892866145b800d129ec63760c6d0102b1a6d789e32af7a0cd63c9ccc9", "evidence_sections": [ "Phase 0: Reconnaissance", "What is Reconnaissance?", "Step 1: Port Scanning with nmap", "Step 1: Exploit Command Injection (Port 30081)", "Step 4: Create a Persistent Backdoor", "Step 5: Exfiltrate Cluster Configuration", "Key Vulnerabilities Exploited" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Phase 0: Reconnaissance", "What is Reconnaissance?" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Phase 1: Initial Access", "What is Initial Access?" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Step 2: Testing Each Service", "Step 1: Extract the Service Account Token" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Objective", "Objective" ] } ] }, { "id": "archive:2026/2026-02-04-my-lab-82d780962213", "title": "My lab:", "url": "https://1200km.com/articles/read/2026/2026-02-04-my-lab-82d780962213/", "kind": "authored", "source_path": "2026/2026-02-04-my-lab-82d780962213.md", "source_sha256": "f057b73767fa9d13ed567f2996540f7b0ac5711f0de9fe851932669724d4f629", "evidence_sections": [ "No technical sections: personal lab overview; no stage-specific placement." ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-02-04-one-prompt-ai-powered-black-box-kubernetes-penetration-test-c75a4747960e", "title": "One-Prompt AI-Powered Black-Box Kubernetes Penetration Test", "url": "https://1200km.com/articles/read/2026/2026-02-04-one-prompt-ai-powered-black-box-kubernetes-penetration-test-c75a4747960e/", "kind": "authored", "source_path": "2026/2026-02-04-one-prompt-ai-powered-black-box-kubernetes-penetration-test-c75a4747960e.md", "source_sha256": "c6451785110fb558dbd1dca538ebb3ee3332f25187228c62c244ea2a6904ec46", "evidence_sections": [ "How Cursor + HexStrike MCP Automatically Discovers and Exploits Vulnerabilities. From single entry point to full cluster compromise", "Example: Network Reconnaissance", "Stage 0: Initial Reconnaissance", "Stage 2: Vulnerability Discovery", "Stage 4: Multiple Exploitation Methods", "Method 1: Command Injection (Multiple Payloads)", "Multiple Exploitation Methods", "Command Injection — 6 Payloads Tested" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Example: Network Reconnaissance", "Stage 0: Initial Reconnaissance" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Executive Summary", "Stage-by-Stage Execution" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Single Entry Point to Full Compromise" ] } ] }, { "id": "archive:2026/2026-02-05-warning-i-just-built-real-malware-by-using-just-human-language-prompts-8949628dee19", "title": "⚠️ WARNING: I Just Built Real Malware by using just human language prompts!", "url": "https://1200km.com/articles/read/2026/2026-02-05-warning-i-just-built-real-malware-by-using-just-human-language-prompts-8949628dee19/", "kind": "authored", "source_path": "2026/2026-02-05-warning-i-just-built-real-malware-by-using-just-human-language-prompts-8949628dee19.md", "source_sha256": "e8ca43c5f74e80620db25644863f2848e2f3adc6d56e73de31ee4a771714c56d", "evidence_sections": [ "A Complete Walkthrough: From “I Want to Build Malware” to Fully Functional Trojan with C2, Keylogger, and Data Exfiltration", "Malware Categories to Develop", "1. Basic Malware Types", "B. Polymorphic Malware", "C. Metamorphic Malware", "Phase 2: Simple Malware (Week 3-4)", "Phase 4: Advanced Malware (Week 7-8)", "Scenario 1: Basic Detection Testing", "For Each Malware Sample", "Step 4: Write Malicious Payload", "Option A: Single Payload", "Network Configuration for Lab Testing", "VM Configuration (NAT Network)", "Modified Phase 1: Payload Preparation", "Detection Considerations", "Testing Detection", "Network Testing", "2. String Obfuscation" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "A. Packer/Protector", "Project Structure" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "3.3 Phase 3: Backdoor Module (Days 7-9)", "3.6 Phase 6: Process Hollowing Loader (Days 16-18)" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "C2 Server Configuration", "3.2 Phase 2: C2 Communication Module (Days 4-6)" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Project Objectives", "5. Binary Packing/Encryption" ] } ] }, { "id": "archive:2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503", "title": "Welcome to the New Era: When a Teenager Can Crash Your Company in Minutes", "url": "https://1200km.com/articles/read/2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503/", "kind": "authored", "source_path": "2026/2026-02-06-welcome-to-the-new-era-when-a-teenager-can-crash-your-company-in-minutes-8818fb6c0503.md", "source_sha256": "2a6034c1a67af9d11514792bef75c4d5d508374e3f9982ffb5cda6c943f094d7", "evidence_sections": [ "An Urgent Message for CISOs and C-Level Executives. The threat landscape has fundamentally changed. Your legacy security assumptions are not just outdated — they’re dangerous.", "“If Our Penetration Test Didn’t Find Domain Controller Compromise, We’re Secure”", "The New Threat Actor: The AI-Enabled “Script Kiddie”", "Real-World Example: The Malware Creation Case", "Automated Scanning and Mass Exploitation", "Real-World Impact", "Business Impact", "The Detection Gap", "Emerging Threats" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-02-09-gcp-penetration-testing-a-step-by-step-attack-guide-9e39bc3eb96d", "title": "GCP Penetration Testing: A Step-by-Step Attack Guide", "url": "https://1200km.com/articles/read/2026/2026-02-09-gcp-penetration-testing-a-step-by-step-attack-guide-9e39bc3eb96d/", "kind": "authored", "source_path": "2026/2026-02-09-gcp-penetration-testing-a-step-by-step-attack-guide-9e39bc3eb96d.md", "source_sha256": "6101fca5d02e4d6695f42db7c4f266760acb02699e67e44b6a7309f1d0146732", "evidence_sections": [ "A practical GCP lab case study: overprivileged identities, leaked creds, weak controls — and how it all chains together", "1. Reconnaissance", "Port Scanning", "2. Cloud Function Command Injection", "Exploitation", "Impact", "Impact", "Exploitation", "Impact", "Exploitation", "Impact", "Impact of Owner Access", "9. Data Exfiltration", "Database Credentials", "Impact of Data Exfiltration", "Why Data Exfiltration is Critical", "10. Persistence Establishment", "Why Persistence Matters" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "1. Reconnaissance", "Port Scanning" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "2. Cloud Function Command Injection", "Exploitation" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Objective", "Objective" ] } ] }, { "id": "archive:2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80", "title": "Kubernetes Logging and Monitoring: Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80/", "kind": "authored", "source_path": "2026/2026-02-11-kubernetes-logging-and-monitoring-complete-guide-2ce9d4bdba80.md", "source_sha256": "2ffc8527efd24932e47461fb0a5320f61ba8be7a0adf5e2bad43cb2b128f9051", "evidence_sections": [ "Option 2: PersistentVolumeClaim (cluster-mounted FS)", "5. Control Plane Logs", "11.5 Cost control and operational focus" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-02-13-build-a-vulnerable-iis-sharepoint-lab-with-fluent-bit-complete-deployment-guide-8fe947e8439e", "title": "Build a Vulnerable IIS SharePoint Lab with Fluent Bit: Complete Deployment Guide", "url": "https://1200km.com/articles/read/2026/2026-02-13-build-a-vulnerable-iis-sharepoint-lab-with-fluent-bit-complete-deployment-guide-8fe947e8439e/", "kind": "authored", "source_path": "2026/2026-02-13-build-a-vulnerable-iis-sharepoint-lab-with-fluent-bit-complete-deployment-guide-8fe947e8439e.md", "source_sha256": "7629855e45a3e6671da78be9eddae79341cf9d5e8c1fca9daaf29df59e36c4a7", "evidence_sections": [ "A full step-by-step guide with all scripts to deploy a vulnerable SharePoint-style site on Windows IIS and ship its logs with Fluent Bit — from scratch.", "3. Provisioning Script: install-iis.ps1", "4. Provisioning Script: install-sharepoint.ps1", "5. Provisioning Script: install-fluent-bit.ps1", "6. Vulnerable SharePoint App" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "6. Vulnerable SharePoint App", "7. IIS Log Types: Access vs Error" ] } ] }, { "id": "archive:2026/2026-02-19-the-complete-guide-to-ai-driven-penetration-testing-cursor-mcp-and-the-modern-pt-workflow-8f27ff19f9ca", "title": "The Complete Guide to AI-Driven Penetration Testing: Cursor, MCP, and the Modern PT Workflow", "url": "https://1200km.com/articles/read/2026/2026-02-19-the-complete-guide-to-ai-driven-penetration-testing-cursor-mcp-and-the-modern-pt-workflow-8f27ff19f9ca/", "kind": "authored", "source_path": "2026/2026-02-19-the-complete-guide-to-ai-driven-penetration-testing-cursor-mcp-and-the-modern-pt-workflow-8f27ff19f9ca.md", "source_sha256": "a6fc3ce19f8e905f44afc1d8db213d9902ab9b98b8a968fad5f91836acde4c44", "evidence_sections": [ "3.2 Install and Update Core Tools", "5.1 Reconnaissance (Recon)", "5.2 Scanning and Enumeration (Scan)", "5.3 Exploitation", "5.4 Post-Exploitation" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "5.1 Reconnaissance (Recon)", "5.2 Scanning and Enumeration (Scan)" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "5.3 Exploitation", "5.4 Post-Exploitation" ] } ] }, { "id": "archive:2026/2026-02-21-one-tool-to-rule-them-all-file-metadata-and-static-analysis-for-malware-analysts-and-soc-t-c6dba1f5b7de", "title": "One Tool to Rule Them All: File Metadata & Static Analysis for Malware Analysts and SOC Teams", "url": "https://1200km.com/articles/read/2026/2026-02-21-one-tool-to-rule-them-all-file-metadata-and-static-analysis-for-malware-analysts-and-soc-t-c6dba1f5b7de/", "kind": "authored", "source_path": "2026/2026-02-21-one-tool-to-rule-them-all-file-metadata-and-static-analysis-for-malware-analysts-and-soc-t-c6dba1f5b7de.md", "source_sha256": "d031a0a1fa7afdf80209dc6a1a2079db2010d7ce33a6e11afe35712bb96a6244", "evidence_sections": [ "Extract hashes, PE/ELF/Mach-O metadata, strings, YARA hits, and deep static analysis — without ever running the file.", "Installation", "Strings and YARA", "Full static analysis ( --full ): maximum metadata, no decompilation", "Real malware: MalwareBazaar integration" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Full static analysis ( --full ): maximum metadata, no decompilation" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] } ] }, { "id": "archive:2026/2026-02-26-a-practical-guide-to-string-analyzer-extract-and-analyze-strings-from-binaries-without-the-875dc74e4868", "title": "A Practical Guide to String Analyzer: Extract and Analyze Strings from Binaries (Without the…", "url": "https://1200km.com/articles/read/2026/2026-02-26-a-practical-guide-to-string-analyzer-extract-and-analyze-strings-from-binaries-without-the-875dc74e4868/", "kind": "authored", "source_path": "2026/2026-02-26-a-practical-guide-to-string-analyzer-extract-and-analyze-strings-from-binaries-without-the-875dc74e4868.md", "source_sha256": "d404d91f36dc06fe6ec88e5b72e53f57b52f0a3f84c33624bd287ca205dc2794", "evidence_sections": [ "A Practical Guide to String Analyzer: Extract and Analyze Strings from Binaries (Without the Headache)", "Why “strings” alone isn’t enough", "Install in under a minute", "2. Unfiltered string dump", "3) Obfuscated / network indicators", "5) Windows API commands (what actions it can perform)", "A) Credential & data theft (file + registry)", "Practical implications for defenders (high-confidence IOCs from your strings)" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "3) Obfuscated / network indicators", "The “obfuscated” flag: what it means" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "A) Credential & data theft (file + registry)" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] } ] }, { "id": "archive:2026/2026-02-26-pe-import-analyzer-a-practical-guide-for-malware-analysts-and-reverse-engineers-29b8b98aeaf3", "title": "PE Import Analyzer: A Practical Guide for Malware Analysts and Reverse Engineers", "url": "https://1200km.com/articles/read/2026/2026-02-26-pe-import-analyzer-a-practical-guide-for-malware-analysts-and-reverse-engineers-29b8b98aeaf3/", "kind": "authored", "source_path": "2026/2026-02-26-pe-import-analyzer-a-practical-guide-for-malware-analysts-and-reverse-engineers-29b8b98aeaf3.md", "source_sha256": "744a2e706bdfa5aba11fc5ca7d122b3f964bcd544ef680eec00c824c30db3536", "evidence_sections": [ "Installation (Under a Minute)", "First Run: One Command, One Report", "Suspicious Combination Detection" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] } ] }, { "id": "archive:2026/2026-02-28-unpacker-a-practical-guide-to-modular-malware-packer-detection-and-unpacking-cf8ba924f25b", "title": "Unpacker: A Practical Guide to Modular Malware Packer Detection and Unpacking", "url": "https://1200km.com/articles/read/2026/2026-02-28-unpacker-a-practical-guide-to-modular-malware-packer-detection-and-unpacking-cf8ba924f25b/", "kind": "authored", "source_path": "2026/2026-02-28-unpacker-a-practical-guide-to-modular-malware-packer-detection-and-unpacking-cf8ba924f25b.md", "source_sha256": "754f5218882f948929d0925c9c8dacbe56ac95c09c74b58352c047282b8125b1", "evidence_sections": [ "Extract and validate unpacked PE/ELF samples with real examples — and prove it using String Analyzer and File Metadata tools.", "Detection: How the Tool Knows What’s Packed", "Validation with String Analyzer", "CMD COMMANDS:", "WINDOWS API COMMANDS:", "CMD COMMANDS:" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "What is Unpacker?", "Unpacking techniques used in this tool" ] } ] }, { "id": "archive:2026/2026-03-01-basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8", "title": "Basic Static Malware Analysis: From Triage to Unpacking — Explained and Automated", "url": "https://1200km.com/articles/read/2026/2026-03-01-basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8/", "kind": "authored", "source_path": "2026/2026-03-01-basic-static-malware-analysis-from-triage-to-unpacking-explained-and-automated-9442ef3b11b8.md", "source_sha256": "f38beb5ca365bd2de8e35132a9981e68149984368676d5df2bab834ea676cc1e", "evidence_sections": [ "What static malware analysis is, why each step matters, and how to run the full workflow in one command with the orchestrator and open-source tools.", "What Is Static Malware Analysis?", "Step 2: String Analysis — What’s Inside Without Running It", "Step 4: Packer Detection and Unpacking — Getting to the Real Code", "Routing: When to Unpack, When to Go Full Static", "Test on Real Malware", "Gathered: Strings (string_analyzer)", "WINDOWS API COMMANDS:", "Gathered: Strings (string_analyzer)", "Gathered: Strings (string_analyzer, unpacked payload)", "Gathered: PE imports (PE-Import-Analyzer, unpacked payload)", "Sample: malware1.exe", "Sample: malware2.exe", "Sample: Cs2Loader_upx.exe", "Gathered: Strings (string_analyzer)", "Sample: malware1.exe", "Sample: malware2.exe", "Sample: Cs2Loader_upx.exe" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "What Is Static Malware Analysis?", "Step 3: PE Import Analysis — What the Binary Can Do" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Sample: Cs2Loader_upx.exe", "Sample: Cs2Loader_upx.exe" ] } ] }, { "id": "archive:2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8", "title": "CTI Research: Handala Hack Group (aka Handala Hack Team)", "url": "https://1200km.com/articles/read/2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8/", "kind": "authored", "source_path": "2026/2026-03-06-cti-research-handala-hack-group-aka-handala-hack-team-ddbdd294cfb8.md", "source_sha256": "928283f58247063d4ecf48639bd0f17b12f3d57d5d45dafd07e4961f5d81164f", "evidence_sections": [ "Evidence-Labeled Threat Intelligence Assessment and SOC Defensive Guidance (December 2023 to March 2026)", "September–October 2024 (High-Impact Claims Against Strategic Targets)", "Initial Access and Delivery", "Impact and Influence", "Detection and Response Priorities", "Detection Engineering Pack (SOC-Ready)", "Controls Mapping (NIST CSF-Lite)", "Network IOCs (IP/CIDR)", "Core delivery/impact artifacts", "Command-Line and Behavioral IOCs" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] }, { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "December 2024–January 2025 (ReutOne Supply-Chain Style Campaign)", "Initial Access and Delivery" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Executive Summary", "Initial Access and Delivery" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "File, Service, and Artifact IOCs" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "September–October 2024 (High-Impact Claims Against Strategic Targets)", "November–December 2025 (Bennett Telegram Compromise and “Bibi Gate” Wave)" ] } ] }, { "id": "archive:2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44", "title": "CTI Research: Sandworm / APT44", "url": "https://1200km.com/articles/read/2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44/", "kind": "authored", "source_path": "2026/2026-03-07-cti-research-sandworm-apt44-649332e8af44.md", "source_sha256": "5f84cc7e2248419e608b1886464c09fe93e39693cea0c241b1075dfa30129609", "evidence_sections": [ "Evidence-Labeled Threat Intelligence Assessment and SOC Defensive Guidance (2009 — March 2026)", "Phase 1: Bespoke High-Impact Disruption (2015–2018)", "Malware and Tooling Portfolio", "Detection and Response Priorities", "Detection Engineering Pack (SOC-Ready)", "Rule 2: FortiGate/VPN Credential Abuse", "Rule 4: Domain-Controller Script Execution Anomaly", "Rule 6: PowerShell Anti-Forensics Detection", "Rule 10: OT-Native Command Misuse ( scilc.exe Pattern)", "Rule 12: Mobile Tactical Exfil (Infamous Chisel / WaveSign Pattern)", "Rule 13: Claim-vs-Telemetry Mismatch Queue", "Rule 14: Kerberos Ticket Forgery / Diamond Ticket Detection", "Rule 16: Edge Device Packet Capture File Detection", "Controls Mapping (NIST CSF-Lite)", "Risk: Edge foothold persistence", "Risk: Rapid destructive impact", "⚠️ Network IOC Shelf-Life Warning", "Network Indicators (December 2025 Poland Incident Chain)" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "February 2022 (Cyclops Blink Public Exposure + Wiper Wave)", "Risk: Battlefield messaging exposure" ] }, { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "Phase 4 (Influence Layer): Distributed Amplification and Attribution Friction (2022–Present)", "Initial Access and Privilege Escalation Patterns (Observed 2021–2026)" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Executive Summary", "2021–2025 (Edge Misconfiguration-Focused Access Campaign)" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "2019–2022 (Kapeka/KnuckleTouch Backdoor Development)", "Risk: Edge foothold persistence" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "Rule 9: Tor-Linked C2 from Non-Approved Assets" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "December 2015 (Ukraine Grid Disruption)", "October 2022 (MicroSCADA Native-Binary Disruption)" ] } ] }, { "id": "archive:2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061", "title": "CTI Research: MuddyWater/Seedworm (Mango Sandstorm)", "url": "https://1200km.com/articles/read/2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061/", "kind": "authored", "source_path": "2026/2026-03-09-cti-research-muddywater-seedworm-mango-sandstorm-ebf6af5ba061.md", "source_sha256": "4a73e539b3ebc29d98b302602313dcc76ce3119220346b4afd73e7a8fe837b49", "evidence_sections": [ "Evidence-Labeled Threat Intelligence Assessment and SOC Defensive Guidance (2017 — March 2026)", "2019–2020: Expansion and First Public CVE Exploitation", "Malware and Tooling Portfolio", "Documented Persistence Methods", "Documented Credential Theft", "Detection Engineering: SOC-Ready Rules", "High-Priority Detections (Immediate Deployment)", "Network Indicators (Validate Recency)", "Persistence", "Credential Access", "Command and Control (C2)", "Exfiltration", "Impact" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] }, { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "Initial Access and Privilege Escalation", "Documented Initial Access Vectors" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Executive Summary", "2019–2020: Expansion and First Public CVE Exploitation" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Documented Persistence Methods", "Persistence" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "Operation Olalampo — First Publicly Documented Telegram-C2 in MuddyWater Toolkit", "Command and Control (C2)" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Documented Credential Theft", "Credential Access" ] } ] }, { "id": "archive:2026/2026-03-11-building-a-dockerized-ai-powered-host-vulnerability-assessment-tool-cd6e2147ce59", "title": "Building a Dockerized AI-Powered Host Vulnerability Assessment Tool", "url": "https://1200km.com/articles/read/2026/2026-03-11-building-a-dockerized-ai-powered-host-vulnerability-assessment-tool-cd6e2147ce59/", "kind": "authored", "source_path": "2026/2026-03-11-building-a-dockerized-ai-powered-host-vulnerability-assessment-tool-cd6e2147ce59.md", "source_sha256": "11d7e50810514a41df010e0a2a746f5f8c72feaa2e578d90138e33cec179fa30", "evidence_sections": [ "Step 1: Install Docker", "LAN Attacker → SMB Exploitation → SUID Binary Privilege Escalation → Full Root Compromise", "Backdoor Account 'xplg' → Persistent Unauthorized Access → Credential Harvesting", "Network Pivot via IPv4 Forwarding → ICMP Redirect Injection → Man-in-the-Middle", "Network", "🟠 Samba (SMB) Ports 139/445 Exposed on All Network Interfaces", "⚪ Multiple Stale Docker Bridge Networks Present", "🟠 John the Ripper Password Cracker Installed", "🟡 libvirt Virtual Network DNS/DHCP Listening on Bridge Interface", "🟡 Multiple Container/VM Bridge Networks Active", "🔵 Crash Reporting / Telemetry Services Enabled", "🔵 SANE Scanner Network Daemon Enabled", "Os Hardening", "🟡 su Command Not Restricted to Wheel/Admin Group", "⚪ 19 CPU Vulnerability Mitigations Present", "⚪ All CPU Vulnerabilities Are Mitigated", "🟠 Vulnerability in libcap2 (CVE-2025-1390)", "🟠 Docker Overlay Network Encryption Bypass (CVE-2023-28840, CVE-2023-28841)" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Executive Summary", "LAN Attacker → SMB Exploitation → SUID Binary Privilege Escalation → Full Root Compromise" ] } ] }, { "id": "archive:2026/2026-03-13-building-a-vulnerable-cloud-pentest-lab-with-terraform-9858ac96b29e", "title": "Building a Vulnerable Cloud Pentest Lab with Terraform", "url": "https://1200km.com/articles/read/2026/2026-03-13-building-a-vulnerable-cloud-pentest-lab-with-terraform-9858ac96b29e/", "kind": "authored", "source_path": "2026/2026-03-13-building-a-vulnerable-cloud-pentest-lab-with-terraform-9858ac96b29e.md", "source_sha256": "5cb878828ec0bc7325cbfe3c429c454f4690979b2e4867eb82a1b3176ebb9e9e", "evidence_sections": [ "(Optional) Clone the Scanner Repo" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "If the link fails with permission denied", "Step 5 — API Enablement & Permissions" ] } ] }, { "id": "archive:2026/2026-03-14-ai-powered-malware-debugger-that-explains-every-function-it-sees-2a28ef75df8a", "title": "AI-Powered Malware Debugger That Explains Every Function It Sees", "url": "https://1200km.com/articles/read/2026/2026-03-14-ai-powered-malware-debugger-that-explains-every-function-it-sees-2a28ef75df8a/", "kind": "authored", "source_path": "2026/2026-03-14-ai-powered-malware-debugger-that-explains-every-function-it-sees-2a28ef75df8a.md", "source_sha256": "bbd733a828e80a216a8db16a3e118444fed9b11fe9cf142a68ceaf2a62d56ead", "evidence_sections": [ "How I combined Claude AI, Frida, Capstone, and a suite of static analysis engines into a reverse engineering tool that talks back", "The Problem With Traditional Malware Analysis", "Layer 1: Static Analysis", "Layer 4: Malware Pattern Detection", "Layer 5: Control Flow Graph", "Layer 8: Persistence (SQLite)", "Step 1: Static fingerprint", "Installation" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Layer 1: Static Analysis", "Step 1: Static fingerprint" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Layer 8: Persistence (SQLite)" ] } ] }, { "id": "archive:2026/2026-03-14-stratusai-i-built-an-ai-powered-cloud-security-scanner-for-aws-and-gcp-here-s-everything-89c6702d3b84", "title": "StratusAI: I Built an AI-Powered Cloud Security Scanner for AWS and GCP — Here’s Everything", "url": "https://1200km.com/articles/read/2026/2026-03-14-stratusai-i-built-an-ai-powered-cloud-security-scanner-for-aws-and-gcp-here-s-everything-89c6702d3b84/", "kind": "authored", "source_path": "2026/2026-03-14-stratusai-i-built-an-ai-powered-cloud-security-scanner-for-aws-and-gcp-here-s-everything-89c6702d3b84.md", "source_sha256": "a44d55007121941e9cbf386fe5294672e453855f841ba67dd5404305aabe0412", "evidence_sections": [ "The AWS Scanner Layer", "IAM Scanner: The Most Important One", "S3 Scanner: The Breach Surface", "Lambda Scanner: The Hidden Attack Surface", "EKS Scanner: The Kubernetes Layer", "The GCP Scanner Layer", "GCP IAM Scanner", "GCP Compute Scanner", "GCP Storage Scanner", "GCP Secret Manager & Logging Scanners", "Installation", "Scan path (option 1) — 7 steps", "Zero-Credential Cloud Function Secret Exfiltration and Full Project Takeover", "Credential Interception via Plaintext HTTP Login and Lateral Movement" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Executive Summary", "Zero-Credential Cloud Function Secret Exfiltration and Full Project Takeover" ] } ] }, { "id": "archive:2026/2026-03-16-navigate-my-blog-all-articles-by-topic-ffd800ef5480", "title": "Navigate My Blog: All Articles by Topic", "url": "https://1200km.com/articles/read/2026/2026-03-16-navigate-my-blog-all-articles-by-topic-ffd800ef5480/", "kind": "authored", "source_path": "2026/2026-03-16-navigate-my-blog-all-articles-by-topic-ffd800ef5480.md", "source_sha256": "dc5de7aff4bd2f4f786e5507b26c7be91334449d31a91b13623197091b37fcfc", "evidence_sections": [ "AI-Driven Pentesting & Exploitation", "Burp Suite, Web Scanners & LLM/MCP", "Reconnaissance & OSINT", "Nmap & Network Scanning", "Metasploit & Exploitation", "Password & Credential Cracking", "Malware Analysis & Forensics", "Threat Hunting & Detection", "CTI & Threat Intelligence" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101", "title": "ATT&CK as a Working Tool: Theory and Hands-On Practical Usage", "url": "https://1200km.com/articles/read/2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101/", "kind": "authored", "source_path": "2026/2026-03-19-att-and-ck-as-a-working-tool-theory-and-hands-on-practical-usage-d63835c9f101.md", "source_sha256": "500bd43b890c48e7b5c70ab88191b0a4cc435d4d6f4fa03c3f5764b9beceb6cd", "evidence_sections": [ "A practitioner’s guide for CTI analysts, detection engineers, and threat hunters", "7. Use Case 1: Mapping a Threat Report to ATT&CK", "9. Use Case 3: Detection Engineering with Sigma + ATT&CK", "From ATT&CK Technique to Detection Rule: The Complete Process", "10. Use Case 4: Threat Hunting with ATT&CK", "Step 4: Detection Priority Analysis", "Step 5: Threat Hunt Derived from Mapping", "Detection Engineering", "Threat Intelligence Platforms with ATT&CK Integration", "Pitfall 5: Ignoring Sub-Technique Granularity in Detection Rules", "High-Priority Detection Techniques (Most Frequently Used in Observed Campaigns)" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-03-20-attribution-methodology-how-to-build-defend-and-challenge-a-threat-actor-attribution-071066437ced", "title": "Attribution Methodology: How to Build, Defend, and Challenge a Threat Actor Attribution", "url": "https://1200km.com/articles/read/2026/2026-03-20-attribution-methodology-how-to-build-defend-and-challenge-a-threat-actor-attribution-071066437ced/", "kind": "authored", "source_path": "2026/2026-03-20-attribution-methodology-how-to-build-defend-and-challenge-a-threat-actor-attribution-071066437ced.md", "source_sha256": "f1dee10dd9e958820cc24d74a8e8863c8b6b88aca1c34b07f118ccb35d0ec13b", "evidence_sections": [ "A practitioner’s guide for CTI analysts — from evidence collection to defensible conclusions", "Table of Contents", "Introduction: Why Attribution Is Hard and Why It Matters", "What Attribution Actually Means", "Why Getting Attribution Wrong Is Worse Than Not Attributing" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c", "title": "Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network", "url": "https://1200km.com/articles/read/2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c/", "kind": "authored", "source_path": "2026/2026-03-21-infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-netwo-1295d50ec29c.md", "source_sha256": "18c24d10dcffca64811a5aaf07edef01287b8db05cdaae321c97f8db16c8a2ce", "evidence_sections": [ "Let’s Encrypt as an Attacker Fingerprint", "BinaryEdge — Alternative Port Scanning Database", "LeakIX — Service Exposure and Misconfiguration Detection", "Full Worked Example: Tracing a C2 Network End-to-End" ], "placements": [ { "stage": "reconnaissance", "note": "Defender reconnaissance of adversary infrastructure, not evidence that the adversary scanned a victim.", "read_sections": [ "Pivot Type 2: Passive DNS — The History Book of the Internet", "What Passive DNS Is" ] }, { "stage": "command-and-control", "note": "Pivot through DNS, certificates, and service fingerprints to expand a candidate C2 infrastructure set without over-attribution.", "read_sections": [ "Pivot Type 2: Passive DNS — The History Book of the Internet", "What Passive DNS Is" ] } ] }, { "id": "archive:2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456", "title": "CVSS v4.0: The Practical Field Guide for Vulnerability Management", "url": "https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/", "kind": "authored", "source_path": "2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456.md", "source_sha256": "97277e4922b74d5a0a3fcf603122c45aacea8a5b102d7a9e0e2ac9a3ca37130c", "evidence_sections": [ "New Impact Model: Two Systems Instead of One", "New Threat Metric: Exploit Maturity (E)", "Anatomy of a CVSS v4.0 Vector String", "Full v4.0 Vector String Format", "Group 2: Threat Metrics (Consumer + Threat Intel)", "Threat Metrics in Practice: KEV, EPSS, and Exploit Feeds", "CISA Known Exploited Vulnerabilities (KEV) Catalog", "The Step-by-Step Threat Metric Determination Workflow", "The Vulnerability", "Hour 48–72: Mass Exploitation — Botnets, Ransomware, State Actors", "Step 2: Add Attack Complexity — Compensating Controls", "Step 3: Add Threat Intelligence", "Step 4: Assess Subsequent System Impact", "OT/ICS (Industrial Control Systems)", "The Practical VM Workflow: From Scanner Output to Prioritized Action", "AU:Y — Automatable Exploitation", "S:P — Safety Impact in OT/Medical", "Mistake 2: Never Setting E:U for CVEs Without Exploit Evidence" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "New Threat Metric: Exploit Maturity (E)", "Threat Metrics in Practice: KEV, EPSS, and Exploit Feeds" ] } ] }, { "id": "archive:2026/2026-03-30-android-apk-analysis-tool-ai-powered-static-malware-analysis-in-your-terminal-4beb239dad12", "title": "Android APK Analysis Tool: AI-Powered Static Malware Analysis in Your Terminal", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-apk-analysis-tool-ai-powered-static-malware-analysis-in-your-terminal-4beb239dad12/", "kind": "authored", "source_path": "2026/2026-03-30-android-apk-analysis-tool-ai-powered-static-malware-analysis-in-your-terminal-4beb239dad12.md", "source_sha256": "2fd994afbd3b7ef65b1266629a3735d0b37eb484dcbe0ef3de892fa009476949", "evidence_sections": [ "Installation", "Phase 1 — Static Analysis", "Phase 2 — Threat Indicator Scoring", "Phase 3 — YARA Scanning", "Batch scan a directory" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Phase 1 — Static Analysis" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] } ] }, { "id": "archive:2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d", "title": "Android Malware Analysis: A Practical Guide for Security Analysts", "url": "https://1200km.com/articles/read/2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d/", "kind": "authored", "source_path": "2026/2026-03-30-android-malware-analysis-a-practical-guide-for-security-analysts-9cda5efb181d.md", "source_sha256": "d8f181f32d9a2ad3b40d6cebcf2a81eec4d988903120e93d7c9221d4a1ac5907", "evidence_sections": [ "From APK unpacking to behavioral analysis — with three real-world malware case studies and a companion automated analysis tool", "Introduction: Why Android Malware Analysis Matters", "Emulator Setup: Install, Deploy, and Connect via ADB", "Step 1 — Install SDK tools and emulator", "Step 2 — Install SDK components and create the AVD", "Android-Malware-Analysis Tool Setup", "Static Analysis: Dissecting Without Running", "Step 4: String Extraction and Pattern Matching", "Step 6: Automated Scan", "Install and Run", "Network Traffic Analysis", "Static Analysis of FluBot", "Static Analysis of Cerberus", "Static Analysis of SpyNote", "Detection Engineering: YARA Rules and IOC Extraction", "Classic vs Tool-Based Detection", "YARA Rules for Android Malware", "Suricata Rules for Network Detection" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "APK Structure: What You Are Actually Analyzing", "Static Analysis: Dissecting Without Running" ] }, { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "Distribution" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Accessibility Services — The Master Key", "Case Study 2: Cerberus — Banking Trojan as a Service" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "Network Traffic Analysis" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ] }, { "id": "archive:2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622", "title": "Building an Android App Analysis Lab on Ubuntu: A Practical Setup Guide", "url": "https://1200km.com/articles/read/2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622/", "kind": "authored", "source_path": "2026/2026-04-06-building-an-android-app-analysis-lab-on-ubuntu-a-practical-setup-guide-4a09fff37622.md", "source_sha256": "eda4d2fe1abb46a29e6c4c209e33dd3f06e7d52b218c2ad1202e64ad0e1d2622", "evidence_sections": [ "A practical step-by-step guide to building an Android malware analysis and security testing lab on Ubuntu", "Layer 2 — Static analysis", "Step 1: Install Java", "Step 2: Install the Android SDK and platform tools", "Step 2.1: Install Android SDK Command-Line Tools and Build-Tools", "Step 3: Install Apktool", "Step 4: Install JADX", "Step 5: Install Frida and Objection", "Step 6: Install MobSF with Docker", "Step 7: Install Drozer", "Step 8: Install Androguard", "Step 9: Install Ghidra", "Step 10: Install supporting utilities", "2. Mixing static and dynamic tooling without a plan" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "archive:2026/2026-04-07-android-emulation-and-virtualisation-2f6b33fcc4aa", "title": "Android Emulation & Virtualisation", "url": "https://1200km.com/articles/read/2026/2026-04-07-android-emulation-and-virtualisation-2f6b33fcc4aa/", "kind": "authored", "source_path": "2026/2026-04-07-android-emulation-and-virtualisation-2f6b33fcc4aa.md", "source_sha256": "2ee0474074808a713b6848ab75c83fda486c0fb4180c8a2cd0e66790a39c7d5b", "evidence_sections": [ "Android SDK & Command-Line Tools Setup", "6. Emulator Command-Line Options Reference", "2. Host Installation", "Variant 2 — Writable-System Emulator (Persistent Across Reboots)", "5. Core Frida Commands" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "archive:2026/2026-04-08-android-apk-vulnerability-research-complete-guide-a8fcae0f4849", "title": "Android APK Vulnerability Research Complete Guide", "url": "https://1200km.com/articles/read/2026/2026-04-08-android-apk-vulnerability-research-complete-guide-a8fcae0f4849/", "kind": "authored", "source_path": "2026/2026-04-08-android-apk-vulnerability-research-complete-guide-a8fcae0f4849.md", "source_sha256": "95c394f01ce713b45aa3b807e8f33bcf941eb4bcc39f0ff15724f83dd66013a1", "evidence_sections": [ "Threat Landscape & Attack Surface", "Modern exploits chain multiple layers. A typical chain:", "APK Anatomy & Static Triage", "7. Useful Inspection Commands", "Static Analysis Workflow", "2. System CA Installation on Rooted Emulator (Recommended)", "4. Network Security Config Patching (Non-Root Alternative)", "Root & Emulator Detection Bypass", "1. Root Detection Bypass (Frida)", "2. Emulator Detection Bypass", "Vulnerability Classes — Deep Dive", "4. Content Provider Vulnerabilities", "ContentProvider Exploitation", "Path Traversal (File Provider Exploitation)", "1. Static and Predictable Keys", "Native Binary Analysis & ARM64 Exploitation", "2. ARM64 Architecture for Exploit Development", "2. String Encryption — Frida Extraction" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Modern exploits chain multiple layers. A typical chain", "Vulnerability Classes — Deep Dive" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "2. String Encryption — Frida Extraction" ] } ] }, { "id": "archive:2026/2026-04-08-deliberately-vulnerable-android-app-covering-every-owasp-mobile-top-10-class-7be775fc6415", "title": "Deliberately Vulnerable Android App Covering Every OWASP Mobile Top 10 Class", "url": "https://1200km.com/articles/read/2026/2026-04-08-deliberately-vulnerable-android-app-covering-every-owasp-mobile-top-10-class-7be775fc6415/", "kind": "authored", "source_path": "2026/2026-04-08-deliberately-vulnerable-android-app-covering-every-owasp-mobile-top-10-class-7be775fc6415.md", "source_sha256": "ebe6d0b22a76caf9f70a12bd65f70acc57e0df8fa38a115e05ee73be7a9731df", "evidence_sections": [ "Why Another Vulnerable App?", "Vulnerability Classes" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Why Another Vulnerable App?", "Vulnerability Classes" ] } ] }, { "id": "archive:2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9", "title": "AI in Offensive Operations: How Threat Actors Use Artificial Intelligence", "url": "https://1200km.com/articles/read/2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9/", "kind": "authored", "source_path": "2026/2026-04-12-ai-in-offensive-operations-how-threat-actors-use-artificial-intelligence-4eaeeaf029a9.md", "source_sha256": "c480f6ca470122d2d57b4f13b88c21ec7b9dcd030bdeae2841e505b465337832", "evidence_sections": [ "6. UIUC One-Day Exploitation Results", "AML.TA0002 — Reconnaissance", "AML.TA0004 / AML.T0052 — Initial Access / Phishing", "AML.T0040 / AML.T0024 — AI Model Inference API Access / Exfiltration via AI Inference API", "AML.T0024 — Exfiltration via AI Inference API", "1. 2024 — Provider Telemetry and Application-Layer Risk", "Immediate Technical Controls" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "AML.TA0002 — Reconnaissance" ] }, { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Supply Chain & Infrastructure" ] }, { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "5. Prompt Injection as an Enterprise Security Problem", "11. LiteLLM and the AI Middleware Supply Chain" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "AML.T0040 / AML.T0024 — AI Model Inference API Access / Exfiltration via AI Inference API", "AML.T0024 — Exfiltration via AI Inference API" ] } ] }, { "id": "archive:2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426", "title": "From Threat Intelligence to Detection: A Practitioner’s Guide", "url": "https://1200km.com/articles/read/2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426/", "kind": "authored", "source_path": "2026/2026-04-14-from-threat-intelligence-to-detection-a-practitioner-s-guide-2d930b168426.md", "source_sha256": "9e57030f44a714ff26de4f1e83277e3ebcf4325de87ebe3259ef571764cf5938", "evidence_sections": [ "Building atomic, collection, correlational, TTP-based, and anomaly detection rules from real adversary behavior.", "Why IOC-Only Detection Fails", "Detection Taxonomy", "Detection Layer Definitions", "3. Lazarus — Trojanized Installer Executed from User Download Path", "4. APT29 — TEARDROP Execution via Encoded Command", "2. APT41 — Repeated Exploitation Attempts Against Same Service", "3. Lazarus — Bulk File Staging Before Exfiltration", "2. APT41 — Exploitation → Web Shell → Lateral Movement Chain", "3. Lazarus — Spear Phish Execution → Persistence → C2 Beacon", "3. Bring Your Own Vulnerable Driver — Lazarus POORTRY/WHIPEDOUT (T1014)", "Anomaly Detection Rules", "The Detection Chain: Layering All Five Tiers", "2. Validation: Testing Your Detection Coverage", "3. Measuring Detection Coverage", "4. Detection-as-Code Workflow", "Telemetry and Schema References", "Detection Frameworks, Tooling, and Validation Datasets" ], "placements": [ { "stage": "installation", "note": "Defensive support: process, service, and state-change analytics help investigate a foothold; validate required event fields and benign controls.", "read_sections": [ "2. APT41 — Repeated Exploitation Attempts Against Same Service", "3. Lazarus — Spear Phish Execution → Persistence → C2 Beacon" ] }, { "stage": "command-and-control", "note": "Defensive support: use network indicators, periodicity, and correlated events to test a C2 hypothesis, not infer a malware family from one alert.", "read_sections": [ "3. Lazarus — Spear Phish Execution → Persistence → C2 Beacon" ] } ] }, { "id": "archive:2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12", "title": "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s…", "url": "https://1200km.com/articles/read/2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12/", "kind": "authored", "source_path": "2026/2026-04-18-what-ai-assisted-offensive-work-actually-means-for-your-detection-program-a-practitioner-s-9c27a8f40f12.md", "source_sha256": "43b7de410cf3d7d37dcd7c4612686461916ee78af434f5d6e0ce079497437b9c", "evidence_sections": [ "What AI-Assisted Offensive Work Actually Means for Your Detection Program: A Practitioner’s Dependency Audit" ], "placements": [ { "stage": "weaponization", "note": "Defensive support: classify artifact-dependent analytics and assess how AI-assisted capability changes affect their durability.", "read_sections": [ "Recorded Separately — Infrastructure dependencies" ] }, { "stage": "installation", "note": "Defensive support: process, service, and state-change analytics help investigate a foothold; validate required event fields and benign controls.", "read_sections": [] }, { "stage": "command-and-control", "note": "Defensive support: use network indicators, periodicity, and correlated events to test a C2 hypothesis, not infer a malware family from one alert.", "read_sections": [] } ] }, { "id": "archive:2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12", "title": "Malicious Activity as a Statistical Signal: Anomaly Detection Engineering", "url": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "kind": "authored", "source_path": "2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12.md", "source_sha256": "a15dc247eb5d92a5da195c1440ed430df1f15fb03acf84832e77815090c0c640", "evidence_sections": [ "Lemon Duck exploitation of Exchange servers {#case-parent-child-lemon-duck-exchange}", "DoejoCrypt activity after Exchange exploitation {#case-parent-child-doejocrypt-exchange}", "4.10 APT41 / Winnti — MESSAGETAP and Database Exfiltration {#410-apt41--winnti--messagetap-2019-and-m-trends-2025-exfiltration-2024}", "5. Detection by Log Source and Security Device", "5.4 Network Detection and Response", "Shannon Entropy for DNS Anomaly Detection {#shannon-entropy-for-dns-anomaly-detection}", "5.9 Detection Source Prioritization Matrix", "6. Credential-Based Attacks: Detection Engineering Deep Dive", "6.4 LSASS Credential Dumping (Sysmon Event 10)", "8. Detection Engineering Patterns and Logic Examples", "8.2 Detection Logic Examples", "Pass-the-Hash — Authentication Hunting Views {#pass-the-hash--ntlm-network-logon-heuristic}", "LSASS Credential Access — Sysmon Event 10" ], "placements": [ { "stage": "reconnaissance", "note": "Defensive support: use rate and frequency anomalies to investigate scanning; baseline legitimate monitoring activity.", "read_sections": [ "Frequency / Rate" ] }, { "stage": "installation", "note": "Defensive support: process, service, and state-change analytics help investigate a foothold; validate required event fields and benign controls.", "read_sections": [ "Rare Process / Service", "State-Change" ] }, { "stage": "command-and-control", "note": "Defensive support: use network indicators, periodicity, and correlated events to test a C2 hypothesis, not infer a malware family from one alert.", "read_sections": [ "Protocol / Application Usage", "Temporal" ] }, { "stage": "actions-on-objectives", "note": "Defensive support: connect data movement, identity abuse, and business impact to a tested detection or incident hypothesis.", "read_sections": [ "Data Movement", "Identity / Access" ] } ] }, { "id": "archive:2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82", "title": "Detecting Malicious Insider Activity: A Technical Detection Engineering Guide", "url": "https://1200km.com/articles/read/2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82/", "kind": "authored", "source_path": "2026/2026-04-22-detecting-malicious-insider-activity-a-technical-detection-engineering-guide-3c3b41e95e82.md", "source_sha256": "cc53285f500c395fd69850f40e1994f0bb2a4480e5157b6c5406a5641170a0cf", "evidence_sections": [ "Detection logic, case evidence from 14 documented incidents, and a four-phase implementation programme — covering deterministic rules, behavioural heuristics, UEBA, exfiltration path coverage, and the telemetry required before any of it works.", "1. Why Insider Detection Is Structurally Harder", "Key structural differences from external threats", "The detection paradox", "2. Insider Threat Taxonomy and Kill Chain", "2.1 Threat Categories", "2.2 The CMU SEI Insider Threat Kill Chain", "4. Detection Methods", "Access creep detection", "Lateral movement with valid credentials", "4.4 Exfiltration Path Coverage", "4.7 Covering-Tracks Detection", "5. Detection Priority Matrix", "6. Required Telemetry", "Phase 2 — Data Exfiltration Coverage (Months 3–6)" ], "placements": [ { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "3.11 Desjardins Group — Employee Data Theft (2017–2019)", "Lateral movement with valid credentials" ] } ] }, { "id": "archive:2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87", "title": "CTI Research: Kubernetes & Cloud-Native Threat Landscape", "url": "https://1200km.com/articles/read/2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87/", "kind": "authored", "source_path": "2026/2026-04-25-cti-research-kubernetes-and-cloud-native-threat-landscape-70373d6d7a87.md", "source_sha256": "23d8d37a38e5781590781caebdc81e4725c17fcc5fc2851058d025bec0073ce4", "evidence_sections": [ "Technical Kill Chain Analysis, Detection Engineering, and Defensive Architecture (2023 — Q2 2026)", "Pillar 1: Threat Actor Landscape & Kill Chains", "1.1 Threat Actor Taxonomy", "1.4 Kinsing — Persistent Opportunistic Cryptominer", "1.7 LLMjacking — Cloud Credential Abuse Against AI Services", "Pillar 2: Telemetry Collection & Visibility Architecture", "2.2 eBPF Runtime Telemetry", "2.3 Telemetry Architecture by Platform", "Pillar 3: Detection Engineering & “Parsers as Code”", "3.2 Detection Rule 1 — Privileged Pod Creation (Backend-Dependent Sigma-Style Example)", "3.2b Detection Rule 1b — Suspicious Privileged DaemonSet in kube-system (Backend-Dependent Sigma-Style Example)", "3.3 Detection Rule 2 — RBAC ClusterRoleBinding Backdoor (YARA-L)", "3.4 Detection Rule 3 — exec-then-Outbound / IMDS Access (Elastic EQL)", "3.5 Detection Rule 4 — Privileged Pod then Host File Access (Sigma Correlation)", "Pillar 4: Defensive Architecture & Hardening", "4.1 Admission Controllers: Enforce Before Scheduling", "4.2 Network Policy: Block IMDS and Constrain Egress", "4.4 RBAC Hardening: Minimize Service Account Token Exposure" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "4.4 RBAC Hardening: Minimize Service Account Token Exposure" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Executive Summary", "1.6 FAMOUS CHOLLIMA — DPRK Fake-Worker / Insider-Access Cluster" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "1.3 TeamTNT RBAC Buster — Kubernetes Backdoor Campaign", "1.4 Kinsing — Persistent Opportunistic Cryptominer" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "Self-Managed Kubernetes / Standard EKS (EC2 Node Groups)", "Block EC2 IMDS for Non-System Pods (EC2 nodes only — not applicable to Fargate)" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "1.5 Slow Pisces / TraderTraitor — DPRK Crypto-Theft via Cloud Identity", "1.7 LLMjacking — Cloud Credential Abuse Against AI Services" ] } ] }, { "id": "archive:2026/2026-04-28-vulnerable-ai-lab-3747e96314dd", "title": "Vulnerable AI Lab", "url": "https://1200km.com/articles/read/2026/2026-04-28-vulnerable-ai-lab-3747e96314dd/", "kind": "authored", "source_path": "2026/2026-04-28-vulnerable-ai-lab-3747e96314dd.md", "source_sha256": "9da75f5719a399548dadb90b2467bef6439e12d80f3960f9816227b229d717c1", "evidence_sections": [ "Technical Guide for Usage, Attack Testing, Scenario Authoring, and Vulnerability Module Development", "Built-In Vulnerability Modules", "Installation And Prerequisites", "Option A — Local Python install (recommended for development)", "Provider credentials" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Technical Guide for Usage, Attack Testing, Scenario Authoring, and Vulnerability Module Development", "Built-In Vulnerability Modules" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Provider credentials" ] } ] }, { "id": "archive:2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86", "title": "AI Offensive Security: Practical Attacks Against LLM Agents", "url": "https://1200km.com/articles/read/2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86/", "kind": "authored", "source_path": "2026/2026-04-29-ai-offensive-security-practical-attacks-against-llm-agents-516dbdabbf86.md", "source_sha256": "8277f5e3dcad71e5f3b27012d41107d7ed4ffafd891a1afc2ce66c824fb408e1", "evidence_sections": [ "Threat Model (applies to all attacks)", "Network Indicators", "Attack 3: Data Exfiltration Through Agent Actions", "Attack 3: Data Exfiltration Through Agent Actions — How to Perform It", "Attack 4: Memory Poisoning (Long-Term Persistence)", "Step 4 — Escalate: plant an exfiltration directive", "Detection gap in this lab", "The built-in attack payload", "Execution path C — Max data harvest before exfil", "Why the detection fires but doesn’t block", "Detection Engineering", "Detection 1 (PSEUDOCODE): Low-Trust Document -> Sensitive Tool Call", "Detection 2 (PSEUDOCODE): External Content -> Outbound Action", "Detection 3 (PSEUDOCODE): Suspicious Memory Write", "Detection 4 (PSEUDOCODE): Sensitive Data in Tool Arguments", "Detection 5 (PSEUDOCODE): New Recipient/Domain", "Detection 6 (PSEUDOCODE): Tool Registry Drift", "Tactical Hardening Checklist" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "Attack 1: Indirect Prompt Injection via RAG/Documents", "Indirect Prompt Injection via RAG — Lab Explanation" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Attack 1: Indirect Prompt Injection via RAG/Documents", "Indirect Prompt Injection via RAG — Lab Explanation" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Attack 3: Data Exfiltration Through Agent Actions", "Attack 3: Data Exfiltration Through Agent Actions — How to Perform It" ] } ] }, { "id": "archive:2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6", "title": "APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise", "url": "https://1200km.com/articles/read/2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6/", "kind": "authored", "source_path": "2026/2026-05-02-apt41-targeting-pharmaceutical-sector-log4shell-to-domain-compromise-9e4c1ba9dad6.md", "source_sha256": "85d1698bb9c7112eee11344e440bf556032166e5f1d99cf9e3eb070530a05d6c", "evidence_sections": [ "Threat Intelligence Report | Operation DragonRx", "2. Threat Actor Profile — APT41", "Primary Malware Families (documented)", "Target Network Architecture (In Lab env for simulation)", "5.1 Reconnaissance — T1596.003, T1596.005, T1592.002, T1589.002, T1595.002", "5.3 Foothold — Two-Layer Persistence — T1505.003, T1053.003", "Network Mapping", "Credential Recovery from Configuration Files — T1552.001", "5.5 Credential Access — T1558.003, T1003.001, T1003.006", "5.8 Exfiltration — T1041, T1048.001", "5.9 Persistence — DLL Sideloading — T1574.002, T1053.005", "5.10 Impact — Ransomware (Optional) — T1562.001, T1490, T1486", "9. Detection Opportunities", "Detection Rules", "Log4Shell — Zeek (network-layer)", "YARA-L 2.0 Detection Rules (Google SecOps / Chronicle UDM)" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "5.1 Reconnaissance — T1596.003, T1596.005, T1592.002, T1589.002, T1595.002", "AD Enumeration from Linux — T1087.002" ] }, { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Documented Rapid Weaponization", "Linux to WS01 — Impacket PsExec (T1021.002)" ] }, { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "5.2 Initial Access — Log4Shell CVE-2021–44228 — T1190" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "1. Executive Summary", "5.2 Initial Access — Log4Shell CVE-2021–44228 — T1190" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "5.3 Foothold — Two-Layer Persistence — T1505.003, T1053.003", "Layer 2: RxPhage Custom Implant — T1053.003" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "Primary Channel: HTTPS via C2 — T1041", "Backup Channel: DNS Tunneling — T1048.001" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Credential Recovery from Configuration Files — T1552.001", "5.5 Credential Access — T1558.003, T1003.001, T1003.006" ] } ] }, { "id": "archive:2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c", "title": "Lab Architecture — Operation DragonRx", "url": "https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/", "kind": "authored", "source_path": "2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c.md", "source_sha256": "51e18974e1481d1b83f58c3bff3a997c21e58fd027e2a159389ace500f2bc289", "evidence_sections": [ "Network Topology", "Host Networking Setup" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "archive:2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df", "title": "Attack Playbook — Operation DragonRx", "url": "https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/", "kind": "authored", "source_path": "2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df.md", "source_sha256": "9b81bd1fd3daa8174dfb523b4b050f4710e62a9ce176029571975b56f6d246a0", "evidence_sections": [ "Phase-by-Phase Attack Guide: Exact Commands Against the Deployed Lab", "Network Reference Card", "Phase 0: Reconnaissance", "0.1 Passive Recon (simulated — no real external footprint in lab)", "2.3 Deploy Sliver Beacon (Operational C2)", "2.4 Deploy RxPhage Implant (Malware Analysis Artifact)", "3.1 Host Information and Network Position", "3.2 Internal Network Sweep", "3.3 Credential Discovery in WEB01 Config", "Phase 4: Credential Access", "4.3 LSASS Dump on WS01 (Credential Demonstration)", "Phase 7: Exfiltration", "Phase 8: DLL Sideloading Persistence on DC01" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Phase 0: Reconnaissance", "0.1 Passive Recon (simulated — no real external footprint in lab)" ] }, { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Phase 1: Initial Access — Log4Shell (CVE-2021–44228)", "3.3 Credential Discovery in WEB01 Config" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Phase 2: Foothold — Webshell + Implant", "2.4 Deploy RxPhage Implant (Malware Analysis Artifact)" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "2.3 Deploy Sliver Beacon (Operational C2)", "7.1 Primary: HTTPS via Sliver C2 (DC01 session)" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "3.3 Credential Discovery in WEB01 Config", "Phase 4: Credential Access" ] } ] }, { "id": "archive:2026/2026-05-08-manual-cti-vs-ai-assisted-cti-a-step-by-step-clock-comparison-ee08325203fc", "title": "Manual CTI vs. AI-Assisted CTI: A Step-by-Step Clock Comparison", "url": "https://1200km.com/articles/read/2026/2026-05-08-manual-cti-vs-ai-assisted-cti-a-step-by-step-clock-comparison-ee08325203fc/", "kind": "authored", "source_path": "2026/2026-05-08-manual-cti-vs-ai-assisted-cti-a-step-by-step-clock-comparison-ee08325203fc.md", "source_sha256": "935c67d82ce7fe399bf0d57e5afdf92420a699742d6b570150bfecc616478086", "evidence_sections": [ "Step 8 — Detect the beaconing pattern", "Step 9 — Find the exfiltration event" ], "placements": [ { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "Step 8 — Detect the beaconing pattern" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Step 9 — Find the exfiltration event" ] } ] }, { "id": "archive:2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979", "title": "CTI Kill Chain: An Analyst Guide With Real-World Evidence", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979/", "kind": "authored", "source_path": "2026/2026-05-09-cti-kill-chain-an-analyst-guide-with-real-world-evidence-c3bef6fd2979.md", "source_sha256": "b0ded927def2b118d6208d074b31971f40af819fa91822113e8974c3140de49b", "evidence_sections": [ "Mapping adversary behavior from preparation to impact without overstating the evidence", "1. Reconnaissance and Precursors", "Example 3: GRIZZLY STEPPE reporting describes phishing payload preparation", "3. Delivery", "Example 1: APT1 used spearphishing as an access path", "4. Exploitation", "Example 1: WannaCry exploited MS17–010 via EternalBlue", "Example 2: NotPetya reportedly used the M.E.Doc update channel and credential-based lateral movement (June 2017)", "Example 3: APT28/APT29 exploited identity trust through phishing and credential theft", "5. Installation", "Example 1: APT1 installed backdoors for access maintenance", "6. Command and Control", "Example 3: Stuxnet contained hardcoded ICS payload logic that operated without active C2 contact after staging", "3. Avoid malware-family and campaign conflation" ], "placements": [ { "stage": "reconnaissance", "note": "The reconnaissance examples distinguish targeting inference from directly observed preparation.", "read_sections": [ "1. Reconnaissance and Precursors", "Example 1: APT1 victimology supports deliberate target selection" ] }, { "stage": "weaponization", "note": "Stuxnet, SUNSPOT, and phishing-payload examples illustrate capability preparation with evidence limits.", "read_sections": [ "2. Weaponization", "Example 2: SUNSPOT weaponized the SolarWinds Orion build process" ] }, { "stage": "delivery", "note": "Phishing, trusted software updates, and SMB propagation demonstrate distinct delivery routes.", "read_sections": [ "Example 3: GRIZZLY STEPPE reporting describes phishing payload preparation", "3. Delivery" ] }, { "stage": "exploitation", "note": "The EternalBlue and identity-trust examples separate vulnerability exploitation from credential-based access.", "read_sections": [ "Executive Summary", "Example 1: APT1 used spearphishing as an access path" ] }, { "stage": "installation", "note": "Backdoor and implant examples explain installation without treating every intrusion as file-based.", "read_sections": [ "Example 1: SUNBURST initial backdoor C2 used stealth and delayed activation", "Example 2: APT29 HAMMERTOSS abused public web services for stealthy C2" ] }, { "stage": "command-and-control", "note": "SUNBURST and HAMMERTOSS illustrate channels; Stuxnet shows why active C2 is not always required.", "read_sections": [ "6. Command and Control", "Example 1: SUNBURST initial backdoor C2 used stealth and delayed activation" ] }, { "stage": "actions-on-objectives", "note": "Data theft, NotPetya disruption, and the distinct Ukraine grid cases demonstrate different objectives.", "read_sections": [ "Mapping adversary behavior from preparation to impact without overstating the evidence", "Example 3: APT28/APT29 exploited identity trust through phishing and credential theft" ] } ] }, { "id": "archive:2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31", "title": "CTI-Led Defensive Strategy for a Cellular Provider (Case Study)", "url": "https://1200km.com/articles/read/2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31/", "kind": "authored", "source_path": "2026/2026-05-09-cti-led-defensive-strategy-for-a-cellular-provider-case-study-c77bc5765b31.md", "source_sha256": "7367fb2d7e48c7c4adb098b258807de19210a99cff864c281ce09f2424f678db", "evidence_sections": [ "The Strategic Threat Model", "Step 5: Convert Public Reporting Into Defensible Threat Models", "Step 6: Build a Threat-Informed Detection Backlog", "Detection theme 1: network-device and management-plane compromise", "Detection theme 2: telecom core reconnaissance and subscriber-data access", "Detection theme 3: hybrid identity and cloud destruction paths", "Detection theme 4: Kubernetes and cloud-native management abuse", "Detection theme 5: public web and customer API compromise", "Detection theme 6: third-party and vendor access abuse", "1. Phishing or vendor-support impersonation", "2. New privileged cloud role or service-principal credential", "5. Network-device config change outside approved window", "Days 31–60: threat-specific hunts", "Reconnaissance and precursors", "Weaponization and delivery", "Exploitation and installation", "Command and control", "Step 11: Build the Tactical Detection Handoff" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "View 1: Public and customer-facing exposure", "Detection theme 2: telecom core reconnaissance and subscriber-data access" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Executive Summary", "Detection theme 2: telecom core reconnaissance and subscriber-data access" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "2. Destructive or disruptive operations during geopolitical tension", "3. Identity and third-party compromise" ] } ] }, { "id": "archive:2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b", "title": "Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide", "url": "https://1200km.com/articles/read/2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b/", "kind": "authored", "source_path": "2026/2026-05-10-applying-sherman-kent-s-analytic-discipline-to-cti-a-practical-analyst-guide-33142ad7553b.md", "source_sha256": "e05679bf2949429e71c079c7ccbeb4adbca62853414b184d8c54fb765ced2ffb", "evidence_sections": [ "Estimative language, evidence discipline, and analytic integrity for cyber threat intelligence", "Example 2: CTI malware behavior can be high confidence while intent remains moderate confidence", "Example 1: APT1 victimology supports targeting assessment, not observed reconnaissance" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03", "title": "Customer-Driven AI CTI Project Template. Part 1: Foundations", "url": "https://1200km.com/articles/read/2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03/", "kind": "authored", "source_path": "2026/2026-05-11-customer-driven-ai-cti-project-template-part-1-foundations-745861507d03.md", "source_sha256": "fb7fe4850bf4e1723a2788870b1df84ef669d1dc7b3678183b664b13524715c6", "evidence_sections": [ "From pure CTI to hands-on detection engineering with strict validation gates", "The core delivery principle is:", "Threat Scenario Priority Scoring", "Mode 3: CTI-to-Detection Engineering Project", "Mode 4: Continuous CTI-to-Detection Program", "AI Operating Controls", "Delivery Artifacts", "Customer Detection Data Model", "Detection Readiness Levels", "Detection CI/CD Requirements", "Multi-SIEM / Multi-Platform Translation Control", "Threat Intelligence Frameworks", "Detection Engineering" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-05-12-customer-driven-ai-cti-project-template-part-2a-phase-by-phase-execution-guide-f9751a8bcb59", "title": "Customer-Driven AI CTI Project Template. Part 2A: Phase-by-Phase Execution Guide", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2a-phase-by-phase-execution-guide-f9751a8bcb59/", "kind": "authored", "source_path": "2026/2026-05-12-customer-driven-ai-cti-project-template-part-2a-phase-by-phase-execution-guide-f9751a8bcb59.md", "source_sha256": "27480fba5c5520671e682cb89a0d311e0913cf3880543fc55b2cfba1cc9f1fcb", "evidence_sections": [ "From pure CTI to hands-on detection engineering with strict validation gates.", "Phase 2: Crown-Jewel and Business-Impact Mapping", "Phase 3: Telemetry and Data Readiness Assessment", "Telemetry Quality Scale", "Telemetry Map Template", "Threat Actor Disambiguation and Tracking Protocol", "Phase 5: Threat Scenario Development", "Phase 6: Hypothesis-Driven Threat Hunting Backlog", "Phase 7: Detection Engineering Design", "Detection Engineering Operational Controls", "Detection CI/CD Requirements", "Multi-SIEM / Multi-Platform Translation Control", "Detection Design Template", "Required Detection Types", "Phase 8: Detection-as-Code Implementation", "Detection File Requirements", "Detection Work-in-Progress (WIP) Metric", "Detection Retirement Process" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943", "title": "Customer-Driven AI CTI Project Template:Part 2B: Reference Toolkit", "url": "https://1200km.com/articles/read/2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943/", "kind": "authored", "source_path": "2026/2026-05-12-customer-driven-ai-cti-project-template-part-2b-reference-toolkit-3a56fab0b943.md", "source_sha256": "736b9ee2abd361dfe58f6e1737ca519559ddfdd0b213d86dac7710ebcf97f5a6", "evidence_sections": [ "From pure CTI to hands-on detection engineering with strict validation gates", "AI Workflow 3: Threat Scenario Drafting", "AI Workflow 5: Detection Drafting", "Task Card 4: Telemetry Feasibility Review", "Task Card 5: Threat Scenario Builder", "Task Card 7: Detection Logic Draft", "Gate D: Detection Design Approval", "Gate F: Final Delivery Approval", "Threat Scenario Register", "Detection Coverage Gap Register", "Detection Backlog", "Detection Health Register", "Customer Detection Data Model Register", "Step 5: Observable and Telemetry", "Step 7: Detection Design", "Final Customer Delivery Package", "Minimum Viable Customer Delivery" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-05-13-customer-driven-ai-cti-project-c0db3cdc1830", "title": "Customer-Driven AI CTI Project", "url": "https://1200km.com/articles/read/2026/2026-05-13-customer-driven-ai-cti-project-c0db3cdc1830/", "kind": "authored", "source_path": "2026/2026-05-13-customer-driven-ai-cti-project-c0db3cdc1830.md", "source_sha256": "6bf81b01704da6dc94b2204fe71f74e1257ccf000948df86c71662cf4894acbc", "evidence_sections": [ "Phase 2: Crown-Jewel and Business-Impact Mapping", "Phase 3: Telemetry and Data Readiness Assessment", "Phase 5: Threat Scenario Development", "Phase 6: Hypothesis-Driven Threat Hunting Backlog", "Phase 7: Detection Engineering Design", "Phase 8: Detection-as-Code Implementation" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-05-18-cti-analyst-field-manual-complete-reference-ef2a370bb21f", "title": "CTI Analyst Field Manual — Complete Reference", "url": "https://1200km.com/articles/read/2026/2026-05-18-cti-analyst-field-manual-complete-reference-ef2a370bb21f/", "kind": "authored", "source_path": "2026/2026-05-18-cti-analyst-field-manual-complete-reference-ef2a370bb21f.md", "source_sha256": "e7ac65bc245ff67add887a55666dc2d919d94de79658cd1edee9f4590dc6b96c", "evidence_sections": [ "A practitioner field manual for cyber threat intelligence: from collection requirements to production detection.", "Single IOC to Network", "Telecom 4G Threats", "Telecom 5G Threats", "Part 8: CTI to Detection", "Intelligence to Detection", "Detection Readiness Levels", "Telemetry Requirements", "Field-Level Telemetry Reference", "EDR Process Telemetry (platform-generic)", "DNS Telemetry", "Example: Telemetry Map for RMM Abuse Behavior", "Detection Backlog", "AI CTI Control Matrix", "Task Control Matrix", "Prompt-Injection Controls", "Hallucination Control", "Detection Backlog Item" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394", "title": "The Intelligent Shield. OpenCTI", "url": "https://1200km.com/articles/read/2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394/", "kind": "authored", "source_path": "2026/2026-05-21-the-intelligent-shield-opencti-057c9b4b9394.md", "source_sha256": "3b7b666c3904f9766b7869bee4d2e7e62840986ce6b0dc5a4342215e8e824ea9", "evidence_sections": [ "Transforming Threat Data into High-Confidence Intelligence", "2.4 Threat Actor Profiling", "4. Threat Intelligence Feeds", "10. Post-Deployment Hardening", "CVE Connector — Zero Vulnerabilities Imported (NVD API Key Bug)", "Example 3 — Import a threat report (PDF / blog post)", "Example 7 — Map your detection coverage against ATT&CK", "Example 8 — Pivot from malware to infrastructure" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-05-22-one-place-for-my-cybersecurity-projects-guides-articles-labs-tools-and-research-workflows-5d358753c86c", "title": "One place for my cybersecurity projects, guides, articles, labs, tools, and research workflows", "url": "https://1200km.com/articles/read/2026/2026-05-22-one-place-for-my-cybersecurity-projects-guides-articles-labs-tools-and-research-workflows-5d358753c86c/", "kind": "authored", "source_path": "2026/2026-05-22-one-place-for-my-cybersecurity-projects-guides-articles-labs-tools-and-research-workflows-5d358753c86c.md", "source_sha256": "943306234f4a8a1a698b6a97b2070c49017634168c42454b7bdda9c7b7aff18b", "evidence_sections": [ "From Scattered Research to a Structured Cybersecurity Knowledge Base", "Recently, I built something I had needed for a long time:", "Why I Built It", "Not Just a List of Links", "A Cross-Platform Knowledge Layer" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0", "title": "Operation Desert Hydra — AI-Assisted CTI Pipeline: MuddyWater to Kibana", "url": "https://1200km.com/articles/read/2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0/", "kind": "authored", "source_path": "2026/2026-05-23-operation-desert-hydra-ai-assisted-cti-pipeline-muddywater-to-kibana-34da7917acf0.md", "source_sha256": "b62907b95636c4b3ead4675817e0049f739e5fa84a18b3b21035e49692ad6c93", "evidence_sections": [ "11 validated detections from public sources, OpenCTI graph, and a one-command lab Table of Contents", "Step 16: BugSleep Malware Detail", "Phase 4: Detection Atlas", "det_mw_0001 — Email Delivery Correlated with Process Spawn", "det_mw_0003 — PowerShell Encoded Command and Script Obfuscation", "det_mw_0005 — Registry Run Key and Startup Folder Persistence", "det_mw_0006 — Scheduled Task with 43-Minute Beacon Interval", "det_mw_0010 — LSASS Memory Access and Credential Tool Execution", "Deploy in One Command", "Step 21: det_mw_0001 — Spearphishing Delivery Chain", "Step 23: det_mw_0003 — PowerShell Encoded Command", "Step 25: det_mw_0005 — Registry Run Key Persistence", "Step 26: det_mw_0006 — Scheduled Task (43-Minute Beacon)", "Scar 5: Detection Design Bugs Found in Review (Before Validation)" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "det_mw_0001 — Email Delivery Correlated with Process Spawn", "Step 21: det_mw_0001 — Spearphishing Delivery Chain" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "det_mw_0002 — Web Service Spawning Interpreter Shell", "det_mw_0005 — Registry Run Key and Startup Folder Persistence" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "det_mw_0006 — Scheduled Task with 43-Minute Beacon Interval", "det_mw_0008b — DNS Tunneling Volume and Entropy" ] } ] }, { "id": "archive:2026/2026-05-29-cti-as-a-code-complete-step-by-step-methodology-dda5ef496a46", "title": "CTI as a Code: Complete Step-by-Step Methodology", "url": "https://1200km.com/articles/read/2026/2026-05-29-cti-as-a-code-complete-step-by-step-methodology-dda5ef496a46/", "kind": "authored", "source_path": "2026/2026-05-29-cti-as-a-code-complete-step-by-step-methodology-dda5ef496a46.md", "source_sha256": "de2f937e079e0cf4194df48f58699653e7fefd9e3ca1d0bcc23ebd9115c15042", "evidence_sections": [ "Version-controlled threat intelligence — from first call to deployed Sigma rule.", "Business impact", "Detection action implied", "Tier 3 - Medium (operational impact, no regulatory trigger)", "Tier 3 - Medium (operational impact, no regulatory trigger)", "Impact if scenario executes undetected", "Step P6: Build the Detection Backlog", "Threat intelligence basis", "Both FAILs trace to open engineering tickets, not missing detection rules." ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "Language for deliverables", "Step R7: Produce Deliverables" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Business impact", "Tier 1 — Critical (compromise triggers regulatory notification or irreversible harm)" ] } ] }, { "id": "archive:2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f", "title": "CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma", "url": "https://1200km.com/articles/read/2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f/", "kind": "authored", "source_path": "2026/2026-05-30-cti-as-a-code-in-practice-reactive-investigation-lifetech-pharma-3e6574b7b85f.md", "source_sha256": "8512dfdafcb47da6cb314fd8d7a6ce925e768786867cfdbb4ae1dd519dfd62ac", "evidence_sections": [ "6. Business impact", "2. Decode the PowerShell Payload", "### VT — Secondary C2 / exfil IP", "### VT — AiTM phishing page domain", "### VT — CFO phishing delivery domain", "### Shodan — Exfil IP", "RDAP — AiTM phishing domain registration date", "### RDAP — CFO phishing delivery domain", "### VT Passive DNS — historical resolutions for exfil IP", "### RIPEstat — BGP routing info for exfil IP", "### ARIN RDAP — IP block owner for exfil IP", "### RDAP — Exfil domain registration", "12. Static Binary Analysis — Hex Editor + Terminal", "VT — search for samples sharing the same Malleable C2 User-Agent string", "Step R4: ATT&CK Mapping — Where Detection Failed", "Step R6: Detection Rules — Four That Would Have Changed the Outcome" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "### VT — AiTM phishing page domain", "### VT — CFO phishing delivery domain" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "6. Business impact", "### VT — Secondary C2 / exfil IP" ] } ] }, { "id": "archive:2026/2026-06-07-adversarygraph-i-built-a-self-hosted-ai-threat-intelligence-platform-here-s-how-to-use-it-0aa7673e6bd8", "title": "AdversaryGraph: I Built a Self-Hosted AI Threat Intelligence Platform — Here’s How to Use It", "url": "https://1200km.com/articles/read/2026/2026-06-07-adversarygraph-i-built-a-self-hosted-ai-threat-intelligence-platform-here-s-how-to-use-it-0aa7673e6bd8/", "kind": "authored", "source_path": "2026/2026-06-07-adversarygraph-i-built-a-self-hosted-ai-threat-intelligence-platform-here-s-how-to-use-it-0aa7673e6bd8.md", "source_sha256": "ed57d06b6ddc36c4a81e1536531f07ea268494f9a8bb7f10a3b5297966293835", "evidence_sections": [ "Core Workflow: Analysing a Threat Report" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-06-16-adversarygraph-v2-0-i-built-a-self-hosted-ai-threat-intelligence-platform-941a80cc5a65", "title": "AdversaryGraph v2.0: I Built a Self-Hosted AI Threat Intelligence Platform", "url": "https://1200km.com/articles/read/2026/2026-06-16-adversarygraph-v2-0-i-built-a-self-hosted-ai-threat-intelligence-platform-941a80cc5a65/", "kind": "authored", "source_path": "2026/2026-06-16-adversarygraph-v2-0-i-built-a-self-hosted-ai-threat-intelligence-platform-941a80cc5a65.md", "source_sha256": "2ba0219f275bcf5153ae340f4c692c3e6f47fce641011df7171ef74fc1bb0710", "evidence_sections": [ "Threat intelligence is useful only when it becomes operational.", "Installation" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-06-19-adversarygraph-usecases-820d03c3a7ab", "title": "AdversaryGraph Usecases", "url": "https://1200km.com/articles/read/2026/2026-06-19-adversarygraph-usecases-820d03c3a7ab/", "kind": "authored", "source_path": "2026/2026-06-19-adversarygraph-usecases-820d03c3a7ab.md", "source_sha256": "6b24e57a47b25061e0a122e87f03a20f1080f094d80b85eb6230fac136fcaf90", "evidence_sections": [ "Usecase number “5” — Sync ThreatFox IOCs", "Usecase number “13” — Build A Sector Threat Brief", "Usecase number “24” — Investigation: Malware Family Behavior Mapping", "Usecase number “27” — Defense: Create Sector-Based Detection Roadmap", "Usecase number “29” — Defense: Create Detection Content From CTI" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-06-19-adversarygraph-v2-5-new-name-new-release-full-ai-cti-platform-capability-map-93cd9224127e", "title": "AdversaryGraph v2.5: New Name, New Release, Full AI CTI Platform Capability Map", "url": "https://1200km.com/articles/read/2026/2026-06-19-adversarygraph-v2-5-new-name-new-release-full-ai-cti-platform-capability-map-93cd9224127e/", "kind": "authored", "source_path": "2026/2026-06-19-adversarygraph-v2-5-new-name-new-release-full-ai-cti-platform-capability-map-93cd9224127e.md", "source_sha256": "d752f99b26c3fa7ce4b9c6d595d2d51bf03d01ab2774c6873e332f604de4348d", "evidence_sections": [ "From ThreatMapper To AdversaryGraph", "Installation Guide" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-06-21-from-log-to-report-using-adversarygraph-eff2e1d8f2cd", "title": "From Log to Report: Using AdversaryGraph!", "url": "https://1200km.com/articles/read/2026/2026-06-21-from-log-to-report-using-adversarygraph-eff2e1d8f2cd/", "kind": "authored", "source_path": "2026/2026-06-21-from-log-to-report-using-adversarygraph-eff2e1d8f2cd.md", "source_sha256": "b1f572e20c7d398b4798846d8a4afb383b5778f54481a6be19801fbac736aedc", "evidence_sections": [ "Step 11: Compare With Threat Actors and Save the Result", "Threat Actor Comparison", "Detection and Hunting Priorities" ], "placements": [ { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] } ] }, { "id": "archive:2026/2026-06-26-adversarygraph-v4-0-i-added-a-full-malware-analysis-workbench-to-my-self-hosted-cti-platfo-8dfbf1db2c9e", "title": "AdversaryGraph v4.0: I Added a Full Malware Analysis Workbench to My Self-Hosted CTI Platform", "url": "https://1200km.com/articles/read/2026/2026-06-26-adversarygraph-v4-0-i-added-a-full-malware-analysis-workbench-to-my-self-hosted-cti-platfo-8dfbf1db2c9e/", "kind": "authored", "source_path": "2026/2026-06-26-adversarygraph-v4-0-i-added-a-full-malware-analysis-workbench-to-my-self-hosted-cti-platfo-8dfbf1db2c9e.md", "source_sha256": "162b63c52204c9be9d3c3a2b86631322e29ef349a0b09c3e50b384de3b0ed9a4", "evidence_sections": [ "Static triage, string extraction, AI full analysis, ATT&CK pivots, IOC enrichment, and detection engineering — all from one self-hosted workbench.", "Malware analysis usually starts with a simple question:", "Principles of Malware Research", "Static Analysis: What Can Be Learned Without Running the File", "1. Malware Analysis Workbench", "2. AI-Assisted Malware Understanding", "Malware Analysis Technology Stack", "MalwareGraph as a Standalone Tool", "Malware Analysis Module Workflow", "Installation" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Static Analysis: What Can Be Learned Without Running the File" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] } ] }, { "id": "archive:2026/2026-06-29-adversarygraph-v5-0-from-cti-mapping-to-attack-simulation-and-siem-validation-21873b2a6c39", "title": "AdversaryGraph v5.0: From CTI Mapping to Attack Simulation and SIEM Validation", "url": "https://1200km.com/articles/read/2026/2026-06-29-adversarygraph-v5-0-from-cti-mapping-to-attack-simulation-and-siem-validation-21873b2a6c39/", "kind": "authored", "source_path": "2026/2026-06-29-adversarygraph-v5-0-from-cti-mapping-to-attack-simulation-and-siem-validation-21873b2a6c39.md", "source_sha256": "96c9e103e092d90a10c27ff6d82ab1ffff9df91f37d60a480f85067e14218500", "evidence_sections": [ "A self-hosted CTI-to-detection workbench for ATT&CK mapping, IOC investigation, malware analysis, asset attack-surface mapping, attack simulation, and detection engineering validation.", "Malware Analysis", "Real Lab Telemetry for Web Scenarios", "How This Fits Detection Engineering", "Example Use Case: Password Spray Detection", "Example Use Case: Web Recon to Exploit-Shaped Telemetry", "Example Use Case: Malware Findings to Detection Validation" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b", "title": "Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…", "url": "https://1200km.com/articles/read/2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b/", "kind": "authored", "source_path": "2026/2026-07-03-comprehensive-cyber-intelligence-research-attacks-against-embedded-systems-hardware-firmwa-8a151f8d5f1b.md", "source_sha256": "5da31dc2ff4bdc2b9907dd56ea14f6db0714cfb1dda5cb609753b760f2b71be6", "evidence_sections": [ "Strategic threat model", "2. Post-compromise persistence is the real risk, not only initial CVE exploitation", "5. Silicon, microcode, GPU, and confidential-computing vulnerabilities change the trust boundary", "Vulnerability classes that matter most", "Threat-intelligence monitoring", "Detection telemetry" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] }, { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "6. SOHO and IoT devices are now strategic proxy infrastructure" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Executive intelligence judgment", "2. Post-compromise persistence is the real risk, not only initial CVE exploitation" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "2. Post-compromise persistence is the real risk, not only initial CVE exploitation" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "2. Post-compromise persistence is the real risk, not only initial CVE exploitation", "3. BMC compromise has become a practical enterprise concern" ] } ] }, { "id": "archive:2026/2026-07-07-when-ai-coding-agents-say-yes-too-easily-testing-suspicious-cybersecurity-prompts-in-curso-55eea06b69bd", "title": "When AI Coding Agents Say Yes Too Easily: Testing Suspicious Cybersecurity Prompts in Cursor", "url": "https://1200km.com/articles/read/2026/2026-07-07-when-ai-coding-agents-say-yes-too-easily-testing-suspicious-cybersecurity-prompts-in-curso-55eea06b69bd/", "kind": "authored", "source_path": "2026/2026-07-07-when-ai-coding-agents-say-yes-too-easily-testing-suspicious-cybersecurity-prompts-in-curso-55eea06b69bd.md", "source_sha256": "d76c42c96cf7b1d9eb0f76cdbd18528ad2704a4b8b86732c1582098af3201116", "evidence_sections": [ "A short experiment with Composer 2.5, Cursor Auto mode, Codex 5.5, and Opus 4.8", "What Happened", "The Safer Responses", "Why the Authorization Claim Is Not Enough", "Why This Small Test Matters" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556", "title": "Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry", "url": "https://1200km.com/articles/read/2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556/", "kind": "authored", "source_path": "2026/2026-07-11-newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556.md", "source_sha256": "fef336e78b4c83c800ffb81630d64c5ff944e2e09866a74403e1339979adef13", "evidence_sections": [ "Practical methods for identity, cloud, CI/CD, runtime, and AI-era threat detection", "What Actually Changed in Detection Engineering", "The Modern Detection Engineering Loop", "Technique 1: Telemetry-First Detection Engineering", "Technique 2: Detection-as-Code With Real Validation", "Minimal detection-as-code structure", "Technique 3: Stateful and Sequence-Based Detection", "Technique 5: Identity, Token, and Session Abuse Detection", "Detection pattern: session context shift", "Technique 6: Cloud Data-Plane and SaaS Activity Detection", "Technique 7: CI/CD and Software Supply Chain Detection", "Detection pattern: privileged workflow touched by untrusted input", "Technique 8: Runtime Detection With eBPF", "What eBPF runtime detection is good at", "Technique 10: Statistical Change Detection Without Magic", "Technique 12: Detection for LLM, Agent, and MCP Workflows", "Required telemetry for agent detection", "Detection pattern: prompt injection leading to tool misuse" ], "placements": [ { "stage": "installation", "note": "Defensive support: process, service, and state-change analytics help investigate a foothold; validate required event fields and benign controls.", "read_sections": [] }, { "stage": "actions-on-objectives", "note": "Defensive support: connect data movement, identity abuse, and business impact to a tested detection or incident hypothesis.", "read_sections": [ "Practical example: S3 data access coverage", "Real-world pattern: Snowflake-style data theft" ] } ] }, { "id": "archive:2026/2026-07-23-adversarygraph-40df3439b90c", "title": "AdversaryGraph", "url": "https://1200km.com/articles/read/2026/2026-07-23-adversarygraph-40df3439b90c/", "kind": "authored", "source_path": "2026/2026-07-23-adversarygraph-40df3439b90c.md", "source_sha256": "228a3ac8a5d5fd11f08e7e26b7a0453a985d916758fb10e2613f82caa7752aea", "evidence_sections": [ "From Security Research Project To CTI-to-Detection Product" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-07-31-i-m-building-an-ai-security-engineering-course-55e29e6c035e", "title": "I’m Building an AI Security Engineering Course", "url": "https://1200km.com/articles/read/2026/2026-07-31-i-m-building-an-ai-security-engineering-course-55e29e6c035e/", "kind": "authored", "source_path": "2026/2026-07-31-i-m-building-an-ai-security-engineering-course-55e29e6c035e.md", "source_sha256": "4506a4778d7af6ce50dcc9def6095d864ad448c86ff63873ebd7d7dbb5a83727", "evidence_sections": [ "Module 01 — AI Security Threat Landscape", "Modules 05–09 — Threat behavior and containment", "Modules 13–14 — Governance and secure delivery" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17", "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy", "url": "https://1200km.com/articles/read/2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17/", "kind": "authored", "source_path": "2026/2026-08-01-ai-security-course-module-00-part-1-introduction-ai-ml-taxonomy-2e26c0740a17.md", "source_sha256": "1cdb7860f5eb0eb722458ded5df4aa3e3b0c3e57b7884b0e3ffd26eaab8b453d", "evidence_sections": [ "Before you secure an AI system, learn what the system is", "Table of contents", "The purpose of Module 00", "Audience, prerequisites, and skip paths", "1. AI, machine learning, deep learning, and generative AI are not synonyms" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c", "title": "AI Security Course, Module 00 — Part 2", "url": "https://1200km.com/articles/read/2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c/", "kind": "authored", "source_path": "2026/2026-08-02-ai-security-course-module-00-part-2-69381c74a59c.md", "source_sha256": "cb1da029edd11bafe6ceec3dfa15788c269325c31381104deae2cad93184ef74", "evidence_sections": [ "10. CTI case study: a phishing classifier", "11. From terminology to controls and evidence" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-08-06-what-is-malware-93746950ce9a", "title": "What Is Malware?", "url": "https://1200km.com/articles/read/2026/2026-08-06-what-is-malware-93746950ce9a/", "kind": "authored", "source_path": "2026/2026-08-06-what-is-malware-93746950ce9a.md", "source_sha256": "ebf32df426c5fdcae711e29310aaa5b27b8d72a8c997e3e673498de374b1c1e5", "evidence_sections": [ "A Clear Guide to Malware Types, Capabilities, and Defenses", "Malware types and capabilities", "4. Droppers, Downloaders, and Loaders", "Downloader", "Loader", "9. Fileless Malware and Living-off-the-Land Techniques", "Detection", "How Malware Labels Fit Together", "How to Reduce Malware Risk", "4. Control Email, Web, and Software Delivery", "7. Segment Networks and Harden Remote Access", "What to Do If Malware Is Suspected" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [] }, { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "4. Droppers, Downloaders, and Loaders", "Downloader" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "7. Backdoors and Remote-Access Trojans", "Remote-Access Trojan" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "4. Droppers, Downloaders, and Loaders", "Downloader" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ] }, { "id": "archive:2026/2026-08-07-how-to-build-a-safe-malware-analysis-lab-with-flare-vm-remnux-and-inetsim-0287d3964602", "title": "How to Build a Safe Malware Analysis Lab with FLARE-VM, REMnux, and INetSim", "url": "https://1200km.com/articles/read/2026/2026-08-07-how-to-build-a-safe-malware-analysis-lab-with-flare-vm-remnux-and-inetsim-0287d3964602/", "kind": "authored", "source_path": "2026/2026-08-07-how-to-build-a-safe-malware-analysis-lab-with-flare-vm-remnux-and-inetsim-0287d3964602.md", "source_sha256": "996ab2c11d85a86ea2d03da7501fc9402df226e2fbf0466b6af91f73c0cf0e3b", "evidence_sections": [ "5. Install FLARE-VM", "Installation phase", "7. Build the isolated analysis network", "Optional controlled egress" ], "placements": [ { "stage": "command-and-control", "note": "Supporting practical guide: isolated FLARE-VM/REMnux networking and INetSim let analysts observe simulated callbacks safely.", "read_sections": [ "8. Configure INetSim" ] } ] }, { "id": "archive:2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6", "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/articles/read/2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6/", "kind": "authored", "source_path": "2026/2026-08-08-ai-security-course-module-00-chapter-3-1bf0411472f6.md", "source_sha256": "71a6d243874f644d05ae34e6e2b3b91ea21b527fd5f136c71a31708b9a97b015", "evidence_sections": [ "Neural Networks and Optimization", "2. Neural-network security objects", "9. Attacker access and the threat-model taxonomy", "14. CTI case study: evading a malware classifier", "15. Controls, ATLAS mapping, and analyst exercise", "Control checklist" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-08-09-assembly-for-malware-analysis-be0679241940", "title": "Assembly for Malware Analysis: A Practical x86/x64 Guide", "url": "https://1200km.com/articles/read/2026/2026-08-09-assembly-for-malware-analysis-be0679241940/", "kind": "authored", "source_path": "2026/2026-08-09-assembly-for-malware-analysis-be0679241940.md", "source_sha256": "988d9cb1e5a62c9b6f491d072aa16aa341470cfb54c59311a3ffef97d085d1f4", "evidence_sections": [ "Install and deploy AIDebug", "Control transfer", "String and block operations", "Step 4: Reconstruct the API arguments", "12. A repeatable malware-analysis workflow", "5. Recover control flow", "Treating a single API as proof of malware", "Mistaking thunks or tail calls for broken control flow" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "1. What assembly really represents", "8. Recovering high-level code structures" ] } ] }, { "id": "archive:2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3", "title": "PE File Structure for Malware Analysis: A Practical Guide", "url": "https://1200km.com/articles/read/2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3/", "kind": "authored", "source_path": "2026/2026-08-10-pe-file-structure-for-malware-analysis-d93acb97d9f3.md", "source_sha256": "6c47faaa39d860702d67699879a3e2e456701b9dd6dac57e6a55ea83a6ae09aa", "evidence_sections": [ "7. The optional header: the loader's map", "16. Load configuration and exploit mitigations", "20. How the Windows loader uses the image" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "1. Why PE structure matters", "8. Data directories: routes to important structures" ] }, { "stage": "installation", "note": "Read the Windows loader, imports, TLS callbacks, and image-mapping sections to interpret installed executable artifacts.", "read_sections": [ "7. The optional header: the loader's map", "20. How the Windows loader uses the image" ] } ] }, { "id": "archive:2026/2026-08-12-strings-analysis-for-malware-analysis-turning-391815ee35e2", "title": "Strings Analysis for Malware Analysis: Turning Binary Text into Defensible Hypotheses", "url": "https://1200km.com/articles/read/2026/2026-08-12-strings-analysis-for-malware-analysis-turning-391815ee35e2/", "kind": "authored", "source_path": "2026/2026-08-12-strings-analysis-for-malware-analysis-turning-391815ee35e2.md", "source_sha256": "92594b87e9853c0d51efce1eb1a592d38c05b937b5c612e0decf0b8f53303a09", "evidence_sections": [ "Strings occupy the middle of the evidence chain", "What a “string” really is", "Why raw `strings` output is not enough", "A repeatable workflow with String Analyzer", "2. Install the tool in the analysis VM", "AIDebug String Intelligence", "Network strings", "Commands and scripts", "High entropy and missing strings", "Turning strings into defender outputs", "Behavioral detections", "What String Analyzer does not claim to do" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Resources" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Registry, file, and system paths" ] }, { "stage": "command-and-control", "note": "Network strings seed candidate domains and URLs; the guide explicitly requires runtime or network corroboration.", "read_sections": [] } ] }, { "id": "archive:2026/2026-08-13-aidebug-3-1-full-release-review", "title": "AIDebug 3.1 Full Release Review: From Binary Intake to String Intelligence", "url": "https://1200km.com/articles/read/2026/2026-08-13-aidebug-3-1-full-release-review/", "kind": "authored", "source_path": "2026/2026-08-13-aidebug-3-1-full-release-review.md", "source_sha256": "09a32a5d0def0f46a10a0c732074a4d26bdefe5294aac3752b10a5987740440e", "evidence_sections": [ "Installation and release-aware setup", "2. Run deterministic static triage", "3. Inspect functions, patterns, and control flow", "5. Use String Intelligence", "6. Reconstruct code with Ghidra", "Recommended end-to-end command sequence" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Stable published package: AIDebug 3.0", "2. Run deterministic static triage" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] } ] }, { "id": "archive:2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d", "title": "AI Security Course, Module 00 — Chapter 4", "url": "https://1200km.com/articles/read/2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d/", "kind": "authored", "source_path": "2026/2026-08-15-ai-security-course-module-00-chapter-4-b8e3de0c3a9d.md", "source_sha256": "6eb96389451e768969e35f4fda8bad85272ecacbd568ce54d6b4a7f34f52ffaa", "evidence_sections": [ "Role labels are not access-control boundaries", "10. Decoding and generation controls", "State the threat model", "Detection hypothesis", "16. Controls, ATLAS mapping, and analyst exercise", "Layered control checklist" ], "placements": [ { "stage": "exploitation", "note": "The prompt-injection and tool-authorization sections explain untrusted-input exploitation; foundational Transformer material is supporting context.", "read_sections": [ "Role labels are not access-control boundaries", "13. Prompt injection and instruction conflicts" ] } ] }, { "id": "archive:2026/2026-08-19-course-review-trainsec-malware-analyst-professional-level-1-203ca89b76a2", "title": "Course Review — TrainSec Malware Analyst Professional — Level 1", "url": "https://1200km.com/articles/read/2026/2026-08-19-course-review-trainsec-malware-analyst-professional-level-1-203ca89b76a2/", "kind": "authored", "source_path": "2026/2026-08-19-course-review-trainsec-malware-analyst-professional-level-1-203ca89b76a2.md", "source_sha256": "0e380063fdc80308f62786276d0ca0c92224b8360fc4b03efc34c5744e10e3df", "evidence_sections": [ "Module 1: Malware-analysis foundations", "Module 4: Static triage and string analysis" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/2026-09-18-ai-agent-vs-human-with-wireshark-six-malware-pcaps-put-to-the-test-63ffeaed97de", "title": "AI Agent vs. Human with Wireshark: Six Malware PCAPs Put to the Test", "url": "https://1200km.com/articles/read/2026/2026-09-18-ai-agent-vs-human-with-wireshark-six-malware-pcaps-put-to-the-test-63ffeaed97de/", "kind": "authored", "source_path": "2026/2026-09-18-ai-agent-vs-human-with-wireshark-six-malware-pcaps-put-to-the-test-63ffeaed97de.md", "source_sha256": "4d3c6cfb66fc5529e792fdaed63df64378af472d67262e683e96b25545404050", "evidence_sections": [ "First to Last: FormBook/XLoader traffic across 15 hosts", "Malware naming required refinement" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "Easy as 123: NetSupport RAT hidden on port 443" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "KongTuke: ClickFix, operational C2, and AD discovery", "It’s a trap!: PowerShell staging and rotating HTTP C2" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "It required observable evidence before claiming compromise" ] } ] }, { "id": "archive:2026/2026-09-20-adversarygraph-vs-ten-malware-pcaps-evidence-7dfd6a0917cf", "title": "AdversaryGraph vs Ten Malware PCAPs: What the Evidence Actually Shows", "url": "https://1200km.com/articles/read/2026/2026-09-20-adversarygraph-vs-ten-malware-pcaps-evidence-7dfd6a0917cf/", "kind": "authored", "source_path": "2026/2026-09-20-adversarygraph-vs-ten-malware-pcaps-evidence-7dfd6a0917cf.md", "source_sha256": "ca1974bfdba40baec30e05a8d4e7202af75754d2cbf06fec45b3ff636d06c3af", "evidence_sections": [ "Spoonwatch: dependency downloads are not automatically malware" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "Sunnystation: a good score can hide missing artifacts", "Spoonwatch: dependency downloads are not automatically malware" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "Nemotodes: port 443 does not make traffic TLS", "You dirty rat!: useful evidence outside HTTP and TLS" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ] }, { "id": "archive:2026/2026-10-02-the-right-question-a-framework-for-auditable-question-discovery-e69142b6d0b5", "title": "The Right Question: A Framework for Auditable Question Discovery", "url": "https://1200km.com/articles/read/2026/2026-10-02-the-right-question-a-framework-for-auditable-question-discovery-e69142b6d0b5/", "kind": "authored", "source_path": "2026/2026-10-02-the-right-question-a-framework-for-auditable-question-discovery-e69142b6d0b5.md", "source_sha256": "c1dae5d4aa1919f97840ce604ecb551ed32451972073dbb71bf8dadcde54bbb2", "evidence_sections": [ "Table of contents", "The problem is not a shortage of questions", "The central thesis", "Positioning against related work", "Knowledge must be bounded before questions are generated" ], "placements": [], "exclusion_reason": "Cross-cutting methodology, infrastructure setup, product overview, publication navigation, or foundations without a sufficiently specific stage workflow; retained in the main Library." }, { "id": "archive:2026/adversarygraph-pcap-investigation-stories", "title": "Can AdversaryGraph Tell the Story of a Malware PCAP?", "url": "https://1200km.com/articles/read/2026/adversarygraph-pcap-investigation-stories/", "kind": "authored", "source_path": "2026/adversarygraph-pcap-investigation-stories.md", "source_sha256": "9f3f7693fc26ea1e6fc91314eb04eccc07342ac8ac4fcab137696fcfb5ef6314", "evidence_sections": [ "Table of contents", "What changed in the reporting flow", "Protocol and actual model", "Measured results", "The twenty cases" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ] }, { "id": "archive:2026/cyberattacks-on-big-pharma-and-its-ecosystem", "title": "Cyberattacks on Big Pharma and Its Ecosystem: Threat Actors, Attack Surfaces, TTPs, and Defensible Lessons", "url": "https://1200km.com/articles/read/2026/cyberattacks-on-big-pharma-and-its-ecosystem/", "kind": "authored", "source_path": "2026/cyberattacks-on-big-pharma-and-its-ecosystem.md", "source_sha256": "144915c635a82daff9931904e89b7ad03e64927564965fa1827eb0149d326c11", "evidence_sections": [ "Threat actors, motives, and attribution confidence", "Detection and defense architecture", "Detect collection and exfiltration" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] }, { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Uptime and recovery pressure", "Operational disruption" ] } ] }, { "id": "site:cyber-knowledge/osint.html", "title": "OSINT Field Guide — Cyber Knowledge", "url": "https://1200km.com/cyber-knowledge/osint.html", "kind": "authored", "source_path": "cyber-knowledge/osint.html", "source_sha256": "91c2254b7539cd49458aba84d5ce6bcf664bb8d096b711fcff1ec4727455abe9", "evidence_sections": [ "Table of contents", "Find less, understand more, and preserve the path between source and conclusion", "Discovery", "Verification", "Protection", "Communication", "Open-source information", "OSINT", "Passive reconnaissance", "Active reconnaissance", "One traceable chain from requirement to supported claim", "Fourteen-module OSINT and reconnaissance practitioner sequence", "Authority, ethics, privacy, safety, and operational security", "ATT&CK knowledge mesh for Authority, ethics, privacy, safety, and operational security", "Intelligence requirements, hypotheses, and collection planning", "ATT&CK knowledge mesh for Intelligence requirements, hypotheses, and collection planning", "Search engines, web archives, public records, and documents", "ATT&CK knowledge mesh for Search engines, web archives, public records, and documents" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Passive reconnaissance", "Active reconnaissance" ] } ] }, { "id": "site:cyber-knowledge/red-team.html", "title": "Red Team Field Guide — Cyber Knowledge", "url": "https://1200km.com/cyber-knowledge/red-team.html", "kind": "authored", "source_path": "cyber-knowledge/red-team.html", "source_sha256": "8a24b15615cdfa817af8fa1cb84e27ae0c3b832393ecb3958aa07e0c630489b0", "evidence_sections": [ "Practice with the 1200km ecosystem", "Table of contents", "How to use this guide", "Foundation track", "Specialist tracks", "Validation track", "Assistance and delivery", "Required engagement record", "Technical foundations — what the operator must understand before tooling", "Networks, DNS, TLS, and HTTP: interpret the path, not only the endpoint", "Identity, authentication, authorization, and session state", "Operating systems, processes, privileges, and persistence", "Cloud, containers, and Kubernetes: separate control planes from workloads", "Telemetry, evidence, uncertainty, and the claim ladder", "Module 1 — Mission, authorization, and methodology", "Red team vs. penetration test vs. vulnerability assessment", "Scope, authorization, and rules of engagement", "Objectives, threat model, and success criteria" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [ "Module 2 — Reconnaissance and attack-surface mapping", "Passive vs. active reconnaissance" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Validation track", "Process and execution context" ] } ] }, { "id": "site:cyber-knowledge/vulnerability-research.html", "title": "Vulnerability R&D Field Guide — Cyber Knowledge", "url": "https://1200km.com/cyber-knowledge/vulnerability-research.html", "kind": "authored", "source_path": "cyber-knowledge/vulnerability-research.html", "source_sha256": "e61aba47b981985638888606db2b22011e2b89ad1dda96d3700291213fa16731", "evidence_sections": [ "Table of contents", "How to use this guide", "Maintain one research record", "Climb an evidence ladder", "Separate adjacent disciplines", "Define “done” before starting", "Technical foundations", "Weakness, vulnerability, and exposure", "State machines and trust boundaries", "Memory and execution model", "Concurrency and temporal correctness", "Measurement and uncertainty", "Safe research environment", "Research governance, authorization, and safety", "Translate permission into testable constraints", "Scope record", "Safety controls", "ATT&CK knowledge mesh for Research governance, authorization, and safety" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Source review and static analysis", "Binary-first triage" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Weakness, vulnerability, and exposure", "Memory and execution model" ] } ] }, { "id": "site:cyber-knowledge/secure-code.html", "title": "Secure Code Field Guide — Cyber Knowledge", "url": "https://1200km.com/cyber-knowledge/secure-code.html", "kind": "authored", "source_path": "cyber-knowledge/secure-code.html", "source_sha256": "8a8756e38aede7e5d3cab5630d83cf129197256ae882301cb06ab58b04f64a7c", "evidence_sections": [ "Table of contents", "How to use this field guide", "Developer path", "Security engineer path", "Engineering leader path", "AI product path", "The application-security operating model", "Minimum artefacts per service", "Risk tiers", "Definition of done", "Core concepts and current standards", "Secure by design", "Secure by default", "Requirement", "Threat model", "Vulnerability", "Risk", "SBOM and provenance" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Vulnerability", "Authorization, object access, and tenant isolation" ] } ] }, { "id": "site:cyber-knowledge/malware-analysis.html", "title": "Malware Analysis Field Guide — Cyber Knowledge", "url": "https://1200km.com/cyber-knowledge/malware-analysis.html", "kind": "authored", "source_path": "cyber-knowledge/malware-analysis.html", "source_sha256": "1c9111cb3af6fbced8abc05f49ef5f6c8119ed7eddc8f88a82837c72663a6a49", "evidence_sections": [ "Table of contents", "Use a question-driven workflow, not a tool parade", "The repeatable analysis loop", "Analyst outcomes", "Identity", "Behavior", "Code understanding", "Defender content", "Intelligence", "Incident decisions", "Observation, inference, and claim discipline", "Evidence states", "Do not conflate", "Build the lab before opening the sample", "Minimum architecture", "Fourteen practitioner modules", "Intake, provenance, and analysis scope", "ATT&CK knowledge mesh for Intake, provenance, and analysis scope" ], "placements": [ { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Static triage: strings, imports, resources, and capabilities", "ATT&CK knowledge mesh for Static triage: strings, imports, resources, and capabilities" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [] } ] }, { "id": "site:cyber-knowledge/blue-team.html", "title": "Blue Team Field Guide — Cyber Knowledge", "url": "https://1200km.com/cyber-knowledge/blue-team.html", "kind": "authored", "source_path": "cyber-knowledge/blue-team.html", "source_sha256": "76380d6760205247f58aa72f9e4f30704710c2860ebc8c3fdd65da2b55fc760d", "evidence_sections": [ "1200km defensive-learning paths", "Table of contents", "How to use this guide", "Analyst track", "Detection engineer track", "Incident responder track", "Program leader track", "Required case record", "Technical foundations — reason from evidence before tools", "Events, observations, alerts, cases, findings, and incidents are different objects", "Time is an evidence field, not a display preference", "Identity, asset, service, vulnerability, and business context", "Base rates, precision, recall, thresholds, and analyst capacity", "Controls and response state: prevention, visibility, analysis, decision, and action", "Module 1 — Defensive mission, operating model, and SOC service", "Roles and decision rights", "Case lifecycle", "Service catalogue" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Identity, asset, service, vulnerability, and business context", "Vulnerability context" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Identity, asset, service, vulnerability, and business context", "Service context" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "Applied exercise — protocol-level beacon investigation" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Encrypted traffic", "Applied exercise — suspicious Kubernetes secret access" ] } ] }, { "id": "site:cyber-knowledge/dfir.html", "title": "DFIR Field Guide — Cyber Knowledge", "url": "https://1200km.com/cyber-knowledge/dfir.html", "kind": "authored", "source_path": "cyber-knowledge/dfir.html", "source_sha256": "d80e36cca6d82c899dda83eebb4284a6a109f19900b0695f6991243d9d12ef72", "evidence_sections": [ "Table of contents", "Operating model and learning outcomes", "Prepare before the alert", "Protect evidence and operations", "Reason from multiple sources", "Recover with verification", "A modern lifecycle", "Core language and evidence states", "Event, alert, case, incident", "Artifact and evidence", "Indicator and behavior", "Acquisition and analysis copy", "Timeline fact and inference", "Containment and eradication", "Fourteen-module DFIR learning path", "Readiness, mandate, governance, and communications", "ATT&CK knowledge mesh for Readiness, mandate, governance, and communications", "Incident declaration, triage, scope, and hypotheses" ], "placements": [ { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Disk, file-system, and persistence forensics", "ATT&CK knowledge mesh for Disk, file-system, and persistence forensics" ] }, { "stage": "command-and-control", "note": "Use the network indicators, protocol analysis, or command-channel evidence; distinguish candidate endpoints from confirmed C2.", "read_sections": [ "Network, DNS, proxy, VPN, and email forensics", "ATT&CK knowledge mesh for Network, DNS, proxy, VPN, and email forensics" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Recover with verification", "Containment, eradication, recovery, communications, and closure" ] } ] }, { "id": "site:cyber-knowledge/cloud-security.html", "title": "Cloud Security Field Guide — Cyber Knowledge", "url": "https://1200km.com/cyber-knowledge/cloud-security.html", "kind": "authored", "source_path": "cyber-knowledge/cloud-security.html", "source_sha256": "eacd8852f4d9535e095512f7ec9611854399d887d8452b4f504c0e5fb7d0f0c9", "evidence_sections": [ "Table of contents", "Operating model and learning outcomes", "Assign every responsibility", "Make identity the control plane", "Build guardrails into delivery", "Detect and recover from reality", "Cloud security is a continuous control loop", "Core cloud-security language", "Control plane and data plane", "Account, subscription, project, tenant", "Human and workload identity", "Landing zone", "Posture, exposure, and exploitability", "Inherited, shared, and customer controls", "Fourteen-module cloud-security learning path", "Shared responsibility, governance, and service ownership", "ATT&CK knowledge mesh for Shared responsibility, governance, and service ownership", "Organizations, landing zones, policy, inventory, and cost guardrails" ], "placements": [ { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Posture, exposure, and exploitability", "Network, edge, service communication, hybrid access, and zero trust" ] }, { "stage": "installation", "note": "Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Shared responsibility, governance, and service ownership", "ATT&CK knowledge mesh for Shared responsibility, governance, and service ownership" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Detect and recover from reality", "Cloud incident response, forensics, containment, and recovery" ] } ] }, { "id": "site:cyber-knowledge/ai-security.html", "title": "AI Security Field Guide — Cyber Knowledge", "url": "https://1200km.com/cyber-knowledge/ai-security.html", "kind": "authored", "source_path": "cyber-knowledge/ai-security.html", "source_sha256": "36f5dcddfa43caa54bdc3a122b2a0f34e0e15fea7806ffa94d479233488564dc", "evidence_sections": [ "Table of contents", "Purpose, mental model, and learning outcomes", "You will be able to", "Evidence you should produce", "Map the AI system before testing it", "Fourteen-module learning path", "AI security foundations and threat landscape", "Working method", "ATT&CK knowledge mesh for AI security foundations and threat landscape", "Architecture, assets, trust boundaries, and AI threat modeling", "Threat-model record", "ATT&CK knowledge mesh for Architecture, assets, trust boundaries, and AI threat modeling", "Training data, ingestion, retrieval, RAG, and knowledge integrity", "RAG integrity workflow", "ATT&CK knowledge mesh for Training data, ingestion, retrieval, RAG, and knowledge integrity", "Model and dependency supply-chain security", "Release evidence", "ATT&CK knowledge mesh for Model and dependency supply-chain security" ], "placements": [ { "stage": "delivery", "note": "Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [ "Model and dependency supply-chain security", "ATT&CK knowledge mesh for Model and dependency supply-chain security" ] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Prompt injection, instruction hierarchy, and secure output handling", "ATT&CK knowledge mesh for Prompt injection, instruction hierarchy, and secure output handling" ] }, { "stage": "actions-on-objectives", "note": "Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [ "Privacy, secrets, confidential data, and model leakage", "ATT&CK knowledge mesh for Privacy, secrets, confidential data, and model leakage" ] } ] }, { "id": "site:ai-offensive.html", "title": "AI-Driven Offensive Security — 1200km", "url": "https://1200km.com/ai-offensive.html", "kind": "authored", "source_path": "ai-offensive.html", "source_sha256": "7b30de1372eedc836536436b92c7dc408113557f9c95ccb39b78cd58a0e5cc2e", "evidence_sections": [ "Git Repositories", "HexStrike AI Platform", "AI-Driven Attack Walkthroughs", "Password Recovery with AI", "AI Tool Development & Hacking", "AI-Enhanced Traditional Tools", "Threat Landscape & Implications" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] }, { "stage": "weaponization", "note": "Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "site:hexstrike.html", "title": "HexStrike AI Penetration Testing Guide — 1200km", "url": "https://1200km.com/hexstrike.html", "kind": "authored", "source_path": "hexstrike.html", "source_sha256": "3298b97004db2e57605016fbddad6b620789d4267f224560c63794ba59087ff1", "evidence_sections": [ "Getting Started", "AI Backend Integration", "Network & Infrastructure Attacks", "Web Application & Cloud", "Password Recovery", "Advanced Scenarios" ], "placements": [ { "stage": "reconnaissance", "note": "Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.", "read_sections": [] }, { "stage": "exploitation", "note": "Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "site:learning-paths/command-shell-validation/", "title": "Validate a command-shell detection candidate", "url": "https://1200km.com/learning-paths/command-shell-validation/", "kind": "practice", "source_path": "learning-paths/command-shell-validation/index.html", "source_sha256": "830d51c8c75a25a2b4c44bc11bf689c3c048f883d5cd78dbab2943af4e5796dd", "evidence_sections": [ "Evidence and candidate", "Inputs and workflow", "Expected output and negative controls", "Failure modes and limitations", "Conclusion and next step", "References", "Follow My Work" ], "placements": [ { "stage": "exploitation", "note": "Supporting exercise: Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [] } ] }, { "id": "site:learning-paths/agent-permission-validation/", "title": "Validate a simulated agent permission boundary", "url": "https://1200km.com/learning-paths/agent-permission-validation/", "kind": "practice", "source_path": "learning-paths/agent-permission-validation/index.html", "source_sha256": "1c884ecb0aaa434aba2e5c4ba4d2736d80601db9e34066913c6963b6397fb535", "evidence_sections": [ "Permission and observation boundary", "Download and run", "Expected output and negative controls", "Visibility limits and conclusion", "References", "Follow My Work" ], "placements": [ { "stage": "exploitation", "note": "Supporting exercise: Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "Permission and observation boundary" ] }, { "stage": "actions-on-objectives", "note": "Supporting exercise: Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ] }, { "id": "site:learning-paths/safe-artifact-triage/", "title": "Triage a reproducible benign artifact", "url": "https://1200km.com/learning-paths/safe-artifact-triage/", "kind": "practice", "source_path": "learning-paths/safe-artifact-triage/index.html", "source_sha256": "3b369e6401a38450dce25c714cb40b12b290bee8666da53fda513b74ad613147", "evidence_sections": [ "Inputs and provenance", "Workflow and corroboration", "Expected structured observation", "Failure and negative cases", "Limitations and next step", "References", "Follow My Work" ], "placements": [ { "stage": "weaponization", "note": "Supporting exercise: Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "Expected structured observation" ] } ] }, { "id": "site:courses/trainsec-malware-analyst-professional-level-1/", "title": "TrainSec Malware Analyst Level 1 Learning Record", "url": "https://1200km.com/courses/trainsec-malware-analyst-professional-level-1/", "kind": "authored", "source_path": "courses/trainsec-malware-analyst-professional-level-1/index.html", "source_sha256": "b39ade629c08bfe0306e3934ef64f5cc65459a0a0d538c4e411b79f152dd8d05", "evidence_sections": [ "Editorial and commercial disclosure", "Syllabus summary", "Format", "Audience", "Course syllabus", "Five supplementary course materials", "What Is Malware?", "How to Build a Safe Malware Analysis Lab with FLARE-VM, REMnux, and INetSim", "Assembly for Malware Analysis: A Practical x86/x64 Guide", "PE File Structure for Malware Analysis: A Practical Guide", "Strings Analysis for Malware Analysis", "Summary and recommendation", "Recommended for practical learners" ], "placements": [ { "stage": "weaponization", "note": "Public independent course review and linked original companions; course access and affiliate disclosures remain on the source page.", "read_sections": [ "Assembly for Malware Analysis: A Practical x86/x64 Guide", "PE File Structure for Malware Analysis: A Practical Guide" ] }, { "stage": "installation", "note": "Public independent course review and linked original companions; course access and affiliate disclosures remain on the source page.", "read_sections": [] } ] }, { "id": "trainsec-net:library:career-guides:cybersecurity-salaries", "title": "Cybersecurity Salaries: How Much Can You Earn in Different Roles?", "url": "https://trainsec.net/library/career-guides/cybersecurity-salaries/", "kind": "trainsec", "evidence_sections": [ "Cybersecurity is often seen as a high-paying field, and in many cases, that reputation is" ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:career-guides:is-malware-analysis-right-for-you", "title": "Is Malware Analysis Right for You?", "url": "https://trainsec.net/library/career-guides/is-malware-analysis-right-for-you/", "kind": "trainsec", "evidence_sections": [ "A lot of people are drawn to malware analysis because it sounds advanced, technical, and" ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:career-guides:malware-analysis-in-the-age-of-ai-what-still-requires-human-skill", "title": "Malware Analysis in the Age of AI: What Still Requires Human Skill?", "url": "https://trainsec.net/library/career-guides/malware-analysis-in-the-age-of-ai-what-still-requires-human-skill/", "kind": "trainsec", "evidence_sections": [ "AI is starting to change malware analysis in ways that are hard to ignore. Some" ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:career-guides:malware-analyst-roadmap", "title": "The Complete Malware Analyst Roadmap: Step-by-Step Guide", "url": "https://trainsec.net/library/career-guides/malware-analyst-roadmap/", "kind": "trainsec", "evidence_sections": [ "If you want to become a Malware Analyst, the biggest mistake is trying to jump" ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:career-guides:why-malware-analysts-need-to-think-like-attackers", "title": "Why Malware Analysts Need to Think Like Attackers", "url": "https://trainsec.net/library/career-guides/why-malware-analysts-need-to-think-like-attackers/", "kind": "trainsec", "evidence_sections": [ "Malware analysts do not just need to understand what malicious code does. They also need" ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:hardware-hacking:best-starter-hardware-hacking-toolkit", "title": "Best starter Hardware Hacking Toolkit", "url": "https://trainsec.net/library/hardware-hacking/best-starter-hardware-hacking-toolkit/", "kind": "trainsec", "evidence_sections": [ "Best starter Hardware Hacking Toolkit by Amichai Yifrach, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:hardware-hacking:the-hitchhikers-guide-to-breaking-secure-boot-jetson-orin-cves", "title": "The Hitchhiker's Guide to Breaking Secure Boot", "url": "https://trainsec.net/library/hardware-hacking/the-hitchhikers-guide-to-breaking-secure-boot-jetson-orin-cves/", "kind": "trainsec", "evidence_sections": [ "The Hitchhiker's Guide to Breaking Secure Boot by Amichai Yifrach, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:hardware-hacking:trojan-horse-implementation-in-hardware", "title": "Trojan Horse Implementation in Hardware", "url": "https://trainsec.net/library/hardware-hacking/trojan-horse-implementation-in-hardware/", "kind": "trainsec", "evidence_sections": [ "Trojan Horse Implementation in Hardware by Amichai Yifrach, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:hardware-hacking:uart-security-the-parity-bit", "title": "Reinventing UART Security: Leveraging the Parity Bit for Robust Protection in OT Networks", "url": "https://trainsec.net/library/hardware-hacking/uart-security-the-parity-bit/", "kind": "trainsec", "evidence_sections": [ "Reinventing UART Security: Leveraging the Parity Bit for Robust Protection in OT Networks by Amichai Yifrach, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:back-to-the-future-of-the-cyber-landscape", "title": "Back to the Future of the Cyber Landscape", "url": "https://trainsec.net/library/malware-analysis/back-to-the-future-of-the-cyber-landscape/", "kind": "trainsec", "evidence_sections": [ "Back to the Future of the Cyber Landscape by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:can-document-files-be-trusted", "title": "Can Document Files Be Trusted?", "url": "https://trainsec.net/library/malware-analysis/can-document-files-be-trusted/", "kind": "trainsec", "evidence_sections": [ "Can Document Files Be Trusted? by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:celebrate-uriel-kosayevs-birthday-with-crazy-price-cuts", "title": "Celebrate Uriel Kosayev's Birthday with crazy price cuts!", "url": "https://trainsec.net/library/malware-analysis/celebrate-uriel-kosayevs-birthday-with-crazy-price-cuts/", "kind": "trainsec", "evidence_sections": [ "Celebrate Uriel Kosayev's Birthday with crazy price cuts!" ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:cyber-ai-friend-or-foe-lessons-from-the-orange-systems-inspiration-session", "title": "Cyber & AI – Friend or Foe? Lessons from the Orange Systems Inspiration Session", "url": "https://trainsec.net/library/malware-analysis/cyber-ai-friend-or-foe-lessons-from-the-orange-systems-inspiration-session/", "kind": "trainsec", "evidence_sections": [ "Cyber & AI – Friend or Foe? Lessons from the Orange Systems Inspiration Session by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:debugging-dll-files-with-ida-disassembler", "title": "Debugging DLL Files with IDA Disassembler", "url": "https://trainsec.net/library/malware-analysis/debugging-dll-files-with-ida-disassembler/", "kind": "trainsec", "evidence_sections": [ "Debugging DLL Files with IDA Disassembler by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:dissecting-ardamax-keylogger", "title": "Dissecting Ardamax Keylogger", "url": "https://trainsec.net/library/malware-analysis/dissecting-ardamax-keylogger/", "kind": "trainsec", "evidence_sections": [ "Dissecting Ardamax Keylogger by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:dissecting-blackbyte-ransomware", "title": "Dissecting the BlackByte Ransomware", "url": "https://trainsec.net/library/malware-analysis/dissecting-blackbyte-ransomware/", "kind": "trainsec", "evidence_sections": [ "Dissecting the BlackByte Ransomware by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:how-malware-really-works-what-most-people-miss", "title": "How Malware Really Works (What Most People Miss)", "url": "https://trainsec.net/library/malware-analysis/how-malware-really-works-what-most-people-miss/", "kind": "trainsec", "evidence_sections": [ "How Malware Really Works (What Most People Miss) by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:intel-audio-driver-unquoted-service-path-vulnerability", "title": "Intel® Audio Driver Unquoted Service Path Vulnerability", "url": "https://trainsec.net/library/malware-analysis/intel-audio-driver-unquoted-service-path-vulnerability/", "kind": "trainsec", "evidence_sections": [ "Intel® Audio Driver Unquoted Service Path Vulnerability by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:join-our-live-workshop-attack-and-defense-remote-thread-injection-and-detection", "title": "Live Workshop: Attack and Defense: Remote Thread Injection and Detection (Recorded)", "url": "https://trainsec.net/library/malware-analysis/join-our-live-workshop-attack-and-defense-remote-thread-injection-and-detection/", "kind": "trainsec", "evidence_sections": [ "Live Workshop: Attack and Defense: Remote Thread Injection and Detection (Recorded) by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:maos-malware-analysis-on-steroids-book", "title": "MAoS – Malware Analysis on Steroids book released", "url": "https://trainsec.net/library/malware-analysis/maos-malware-analysis-on-steroids-book/", "kind": "trainsec", "evidence_sections": [ "MAoS – Malware Analysis on Steroids book released by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:meet-uriel-kosayev-def-con-34", "title": "Meet TrainSec Co-Founder Uriel Kosayev at DEF CON 34", "url": "https://trainsec.net/library/malware-analysis/meet-uriel-kosayev-def-con-34/", "kind": "trainsec", "evidence_sections": [ "Meet TrainSec Co-Founder Uriel Kosayev at DEF CON 34 by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:microsoft-wslservice-unquoted-service-path-vulnerability", "title": "Microsoft WslService Unquoted Service Path Vulnerability", "url": "https://trainsec.net/library/malware-analysis/microsoft-wslservice-unquoted-service-path-vulnerability/", "kind": "trainsec", "evidence_sections": [ "Microsoft WslService Unquoted Service Path Vulnerability by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:msi-truecolor-unquoted-service-path", "title": "MSI TrueColor Unquoted Service Path", "url": "https://trainsec.net/library/malware-analysis/msi-truecolor-unquoted-service-path/", "kind": "trainsec", "evidence_sections": [ "MSI TrueColor Unquoted Service Path by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:muddywater-initial-access-trojan", "title": "MuddyWater Initial Access Trojan", "url": "https://trainsec.net/library/malware-analysis/muddywater-initial-access-trojan/", "kind": "trainsec", "evidence_sections": [ "MuddyWater Initial Access Trojan by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:one-electron-to-rule-them-all", "title": "One Electron to Rule Them All", "url": "https://trainsec.net/library/malware-analysis/one-electron-to-rule-them-all/", "kind": "trainsec", "evidence_sections": [ "One Electron to Rule Them All" ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:reverse-engineering-arm-based-mirai-botnet", "title": "Reverse Engineering ARM based Mirai Botnet", "url": "https://trainsec.net/library/malware-analysis/reverse-engineering-arm-based-mirai-botnet/", "kind": "trainsec", "evidence_sections": [ "Reverse Engineering ARM based Mirai Botnet by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:the-malware-shlayer", "title": "The Malware Shlayer", "url": "https://trainsec.net/library/malware-analysis/the-malware-shlayer/", "kind": "trainsec", "evidence_sections": [ "The Malware Shlayer by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:two-sides-of-the-same-coin-from-dissected-malware-to-edr-evasion", "title": "Two Sides of The Same Coin - From Dissected Malware to EDR Evasion", "url": "https://trainsec.net/library/malware-analysis/two-sides-of-the-same-coin-from-dissected-malware-to-edr-evasion/", "kind": "trainsec", "evidence_sections": [ "Two Sides of The Same Coin - From Dissected Malware to EDR Evasion by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:malware-analysis:wannacry-dropper-analysis-itsy-bitsy-tricks-that-break-your-tools", "title": "WannaCry Dropper Analysis: Itsy Bitsy Tricks That Break Your Tools", "url": "https://trainsec.net/library/malware-analysis/wannacry-dropper-analysis-itsy-bitsy-tricks-that-break-your-tools/", "kind": "trainsec", "evidence_sections": [ "WannaCry Dropper Analysis: Itsy Bitsy Tricks That Break Your Tools by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:programming:rundll32", "title": "Understanding RunDLL32: Leveraging Dynamic Function Invocation", "url": "https://trainsec.net/library/programming/rundll32/", "kind": "trainsec", "evidence_sections": [ "Understanding RunDLL32: Leveraging Dynamic Function Invocation by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:programming:sharing-kernel-objects-by-name-perks-and-perils", "title": "Sharing Kernel Objects by Name - Perks and Perils", "url": "https://trainsec.net/library/programming/sharing-kernel-objects-by-name-perks-and-perils/", "kind": "trainsec", "evidence_sections": [ "Sharing Kernel Objects by Name - Perks and Perils by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:programming:shell-icon-handler-extension", "title": "Shell Icon Handler extension", "url": "https://trainsec.net/library/programming/shell-icon-handler-extension/", "kind": "trainsec", "evidence_sections": [ "Shell Icon Handler extension by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:programming:windows-system-programming-in-rust", "title": "Windows System Programming In Rust", "url": "https://trainsec.net/library/programming/windows-system-programming-in-rust/", "kind": "trainsec", "evidence_sections": [ "Windows System Programming In Rust by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:soc-and-dfir:reality-of-securing-modern-data-centers", "title": "You Can’t Sleep in the AI Era: The Brutal Reality of Securing Modern Data Centers", "url": "https://trainsec.net/library/soc-and-dfir/reality-of-securing-modern-data-centers/", "kind": "trainsec", "evidence_sections": [ "You Can’t Sleep in the AI Era: The Brutal Reality of Securing Modern Data Centers by Uriel Kosayev, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:anti-malware-scan-interface-c-sharp", "title": "AMSI Scanning in C#: P/Invoke, Memory-Mapped Files, and Safe Interop", "url": "https://trainsec.net/library/windows-internals/anti-malware-scan-interface-c-sharp/", "kind": "trainsec", "evidence_sections": [ "AMSI Scanning in C#: P/Invoke, Memory-Mapped Files, and Safe Interop by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:application-types-on-windows", "title": "“Application Types” on Windows", "url": "https://trainsec.net/library/windows-internals/application-types-on-windows/", "kind": "trainsec", "evidence_sections": [ "“Application Types” on Windows by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:blue-screen-of-death-a-practical-deep-dive", "title": "Exploring the Blue Screen of Death: A Practical Deep Dive", "url": "https://trainsec.net/library/windows-internals/blue-screen-of-death-a-practical-deep-dive/", "kind": "trainsec", "evidence_sections": [ "Exploring the Blue Screen of Death: A Practical Deep Dive by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:building-a-process-tree", "title": "Building a Process Tree", "url": "https://trainsec.net/library/windows-internals/building-a-process-tree/", "kind": "trainsec", "evidence_sections": [ "Building a Process Tree" ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:building-a-simple-rpc-client-and-server-a-step-by-step-guide", "title": "Building a Simple RPC Client and Server: A Step-by-Step Guide", "url": "https://trainsec.net/library/windows-internals/building-a-simple-rpc-client-and-server-a-step-by-step-guide/", "kind": "trainsec", "evidence_sections": [ "Building a Simple RPC Client and Server: A Step-by-Step Guide by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:capture-etw-events-with-c-part-1", "title": "Capture ETW events with C++ (Part 1)", "url": "https://trainsec.net/library/windows-internals/capture-etw-events-with-c-part-1/", "kind": "trainsec", "evidence_sections": [ "Capture ETW events with C++ (Part 1) by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:capture-etw-events-with-c-part-2", "title": "Capture ETW events with C++ (Part 2)", "url": "https://trainsec.net/library/windows-internals/capture-etw-events-with-c-part-2/", "kind": "trainsec", "evidence_sections": [ "Capture ETW events with C++ (Part 2) by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:code-injection-with-image-file-execution-options", "title": "Code Injection with Image File Execution Options", "url": "https://trainsec.net/library/windows-internals/code-injection-with-image-file-execution-options/", "kind": "trainsec", "evidence_sections": [ "Code Injection with Image File Execution Options by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "installation", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:creating-com-objects-with-the-class-moniker-cogetobject", "title": "Creating COM Objects with the Class Moniker (CoGetObject)", "url": "https://trainsec.net/library/windows-internals/creating-com-objects-with-the-class-moniker-cogetobject/", "kind": "trainsec", "evidence_sections": [ "Creating COM Objects with the Class Moniker (CoGetObject) by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:crowdstrike-and-the-formidable-bsod", "title": "CrowdStrike and the Formidable BSOD", "url": "https://trainsec.net/library/windows-internals/crowdstrike-and-the-formidable-bsod/", "kind": "trainsec", "evidence_sections": [ "CrowdStrike and the Formidable BSOD" ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:delete-a-file-in-windows", "title": "How to Delete a File in Windows (and What “Delete” Really Means)", "url": "https://trainsec.net/library/windows-internals/delete-a-file-in-windows/", "kind": "trainsec", "evidence_sections": [ "How to Delete a File in Windows (and What “Delete” Really Means)" ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:dll-injection-with-windows-application-verifier", "title": "DLL Injection with Windows Application Verifier", "url": "https://trainsec.net/library/windows-internals/dll-injection-with-windows-application-verifier/", "kind": "trainsec", "evidence_sections": [ "DLL Injection with Windows Application Verifier by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "installation", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "What Gets Written to the Registry" ] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:exploring-ntfs-alternate-streams-a-hidden-gem-of-the-windows-file-system", "title": "Exploring NTFS Alternate Streams: A Hidden Gem of the Windows File System", "url": "https://trainsec.net/library/windows-internals/exploring-ntfs-alternate-streams-a-hidden-gem-of-the-windows-file-system/", "kind": "trainsec", "evidence_sections": [ "Exploring NTFS Alternate Streams: A Hidden Gem of the Windows File System by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "installation", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:hiding-a-service-with-c", "title": "Hiding a Service with C++", "url": "https://trainsec.net/library/windows-internals/hiding-a-service-with-c/", "kind": "trainsec", "evidence_sections": [ "Hiding a Service with C++ by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "installation", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Step 1: Open The SCM And The Service", "Step 2: Query The Service Security Descriptor" ] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:hiding-a-windows-service", "title": "Hiding A Windows Service From Enumeration", "url": "https://trainsec.net/library/windows-internals/hiding-a-windows-service/", "kind": "trainsec", "evidence_sections": [ "Hiding A Windows Service From Enumeration by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "installation", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Where Services Are Registered", "Why Services.msc and sc.exe Can Miss A Service" ] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:how-to-embed-and-extract-custom-pe-resources-in-c-findresource-loadresource-makeintresource", "title": "How to Embed and Extract Custom PE Resources in C++", "url": "https://trainsec.net/library/windows-internals/how-to-embed-and-extract-custom-pe-resources-in-c-findresource-loadresource-makeintresource/", "kind": "trainsec", "evidence_sections": [ "How to Embed and Extract Custom PE Resources in C++ by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "weaponization", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "What Are String Table Resources and How Do You Read Them at Runtime?", "How Do You Create a Custom Resource Type and Import a Binary File?" ] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:how-to-scan-files-with-the-anti-malware-scan-interface-in-windows", "title": "How to scan files with the Anti-Malware Scan Interface in Windows?", "url": "https://trainsec.net/library/windows-internals/how-to-scan-files-with-the-anti-malware-scan-interface-in-windows/", "kind": "trainsec", "evidence_sections": [ "How to scan files with the Anti-Malware Scan Interface in Windows? by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "delivery", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:how-windows-app-execution-aliases-work-and-how-to-read-them-in-c", "title": "How Windows App Execution Aliases Work (and How to Read Them in C++)", "url": "https://trainsec.net/library/windows-internals/how-windows-app-execution-aliases-work-and-how-to-read-them-in-c/", "kind": "trainsec", "evidence_sections": [ "How Windows App Execution Aliases Work (and How to Read Them in C++) by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:how-windows-pe-files-use-custom-resources-to-embed-anything", "title": "How Windows PE Files Use Custom Resources to Embed Anything", "url": "https://trainsec.net/library/windows-internals/how-windows-pe-files-use-custom-resources-to-embed-anything/", "kind": "trainsec", "evidence_sections": [ "How Windows PE Files Use Custom Resources to Embed Anything by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "weaponization", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the capability, binary structure, or payload-preparation analysis to understand what an artifact may do; corroborate runtime behavior.", "read_sections": [ "How Does Process Explorer Hide a Driver and a 64-bit Binary Inside Itself?" ] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:inside-the-windows-recycle-bin-what-really-happens-when-you-delete-a-file", "title": "Inside the Windows Recycle Bin - What Really Happens When You Delete a File?", "url": "https://trainsec.net/library/windows-internals/inside-the-windows-recycle-bin-what-really-happens-when-you-delete-a-file/", "kind": "trainsec", "evidence_sections": [ "Inside the Windows Recycle Bin - What Really Happens When You Delete a File? by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:inside-windows-sessions", "title": "Inside Windows Sessions: A Deep Dive with Pavel", "url": "https://trainsec.net/library/windows-internals/inside-windows-sessions/", "kind": "trainsec", "evidence_sections": [ "Inside Windows Sessions: A Deep Dive with Pavel by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:introduction-to-the-windows-performance-analyzer", "title": "Introduction to the Windows Performance Analyzer (WPA)", "url": "https://trainsec.net/library/windows-internals/introduction-to-the-windows-performance-analyzer/", "kind": "trainsec", "evidence_sections": [ "Introduction to the Windows Performance Analyzer (WPA) by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:introduction-to-windows-services", "title": "Introduction to Windows Services", "url": "https://trainsec.net/library/windows-internals/introduction-to-windows-services/", "kind": "trainsec", "evidence_sections": [ "Introduction to Windows Services by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:kernel-allocation-tags-in-windows-explained", "title": "Kernel Allocation Tags in Windows Explained", "url": "https://trainsec.net/library/windows-internals/kernel-allocation-tags-in-windows-explained/", "kind": "trainsec", "evidence_sections": [ "Kernel Allocation Tags in Windows Explained by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:kernel-debugging-windows-vms-a-practical-walk-through", "title": "Kernel Debugging Windows VMs – A Practical Walk-Through", "url": "https://trainsec.net/library/windows-internals/kernel-debugging-windows-vms-a-practical-walk-through/", "kind": "trainsec", "evidence_sections": [ "Kernel Debugging Windows VMs – A Practical Walk-Through by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:keyboard-hook-with-with-image-file-execution-options", "title": "Keyboard Hook with Image File Execution Options", "url": "https://trainsec.net/library/windows-internals/keyboard-hook-with-with-image-file-execution-options/", "kind": "trainsec", "evidence_sections": [ "Keyboard hooking using Image File Execution Options and pretending to be a debugger." ], "placements": [ { "stage": "installation", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] }, { "stage": "actions-on-objectives", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:live-windows-research-using-windbg", "title": "Windows Research with WinDBG - 4H Live (7th April) masterclass with Pavel", "url": "https://trainsec.net/library/windows-internals/live-windows-research-using-windbg/", "kind": "trainsec", "evidence_sections": [ "Windows Research with WinDBG - 4H Live (7th April) masterclass with Pavel by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:looking-into-windows-access-masks", "title": "Looking into Windows Access Masks", "url": "https://trainsec.net/library/windows-internals/looking-into-windows-access-masks/", "kind": "trainsec", "evidence_sections": [ "Looking into Windows Access Masks by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:maximum-handles-in-a-process", "title": "Maximum Handles in a process", "url": "https://trainsec.net/library/windows-internals/maximum-handles-in-a-process/", "kind": "trainsec", "evidence_sections": [ "Maximum Handles in a process by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:ntfs-transactions-in-windows-kernel-transaction-manager-createfiletransacted-and-process-doppelganging", "title": "NTFS Transactions in Windows: Kernel Transaction Manager, CreateFileTransacted, and Process Doppelganging", "url": "https://trainsec.net/library/windows-internals/ntfs-transactions-in-windows-kernel-transaction-manager-createfiletransacted-and-process-doppelganging/", "kind": "trainsec", "evidence_sections": [ "NTFS Transactions in Windows: Kernel Transaction Manager, CreateFileTransacted, and Process Doppelganging by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "installation", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Registry Transactions" ] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:process-memory-map-in-code-mapped-files-and-dos-paths-part-2", "title": "Process Memory Map in Code: Mapped Files and DOS Paths (Part 2)", "url": "https://trainsec.net/library/windows-internals/process-memory-map-in-code-mapped-files-and-dos-paths-part-2/", "kind": "trainsec", "evidence_sections": [ "Pavel Yosifovich extends his MemMap tool with GetMappedFileName, then converts raw NT device paths into ordinary drive-letter paths." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:process-memory-map-in-code-thread-stacks-and-tebs-part-3", "title": "Process Memory Map in Code: Thread Stacks and TEBs (Part 3)", "url": "https://trainsec.net/library/windows-internals/process-memory-map-in-code-thread-stacks-and-tebs-part-3/", "kind": "trainsec", "evidence_sections": [ "Pavel Yosifovich extends his MemMap tool to enumerate threads, locate each Thread Environment Block, and read thread stack limits with ReadProcessMemory." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:process-memory-map-in-code-walking-virtualqueryex-and-finding-the-peb-part-1", "title": "Process Memory Map in Code (Part 1): Walking Process Virtual Address Space", "url": "https://trainsec.net/library/windows-internals/process-memory-map-in-code-walking-virtualqueryex-and-finding-the-peb-part-1/", "kind": "trainsec", "evidence_sections": [ "Pavel Yosifovich writes a C++ tool that reads a Windows process's memory map with VirtualQueryEx, matching VMMap in code and locating the PEB." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:process-snapshotting-in-windows", "title": "How to Capture a Process Snapshot in Windows", "url": "https://trainsec.net/library/windows-internals/process-snapshotting-in-windows/", "kind": "trainsec", "evidence_sections": [ "How to Capture a Process Snapshot in Windows by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:process-tree-in-windows", "title": "How to Build a Process Tree in Windows with Code", "url": "https://trainsec.net/library/windows-internals/process-tree-in-windows/", "kind": "trainsec", "evidence_sections": [ "How to Build a Process Tree in Windows with Code by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:protected-processes-ppl-keeping-windows-heart-safe", "title": "Protected Processes & PPL: keeping Windows’ heart safe", "url": "https://trainsec.net/library/windows-internals/protected-processes-ppl-keeping-windows-heart-safe/", "kind": "trainsec", "evidence_sections": [ "Protected Processes & PPL: keeping Windows’ heart safe by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:running-an-executable-as-system", "title": "Running an Executable as SYSTEM: Unlocking Windows Privilege Escalation Techniques", "url": "https://trainsec.net/library/windows-internals/running-an-executable-as-system/", "kind": "trainsec", "evidence_sections": [ "Running an Executable as SYSTEM: Unlocking Windows Privilege Escalation Techniques by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "exploitation", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the vulnerability, execution, or access-abuse walkthrough and its stated lab or evidence boundaries.", "read_sections": [ "🧪 Final Result: SYSTEM-Level Execution" ] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:understanding-the-differences-between-createprocessasuser-and-createprocesswithtokenw-in-windows", "title": "Understanding the Differences Between CreateProcessAsUser and CreateProcessWithTokenW in Windows", "url": "https://trainsec.net/library/windows-internals/understanding-the-differences-between-createprocessasuser-and-createprocesswithtokenw-in-windows/", "kind": "trainsec", "evidence_sections": [ "Understanding the Differences Between CreateProcessAsUser and CreateProcessWithTokenW in Windows by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:understanding-uac-virtualization", "title": "Understanding UAC Virtualization: A Security Mechanism for Legacy Applications", "url": "https://trainsec.net/library/windows-internals/understanding-uac-virtualization/", "kind": "trainsec", "evidence_sections": [ "Understanding UAC Virtualization: A Security Mechanism for Legacy Applications by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:vmmap-basics-how-to-read-a-windows-processs-memory-layout", "title": "VMMap Basics: How to Read a Windows Process's Memory Layout", "url": "https://trainsec.net/library/windows-internals/vmmap-basics-how-to-read-a-windows-processs-memory-layout/", "kind": "trainsec", "evidence_sections": [ "Pavel Yosifovich uses VMMap to break down a process's memory layout, for developers and researchers who want to see what memory a process really uses." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:when-process-hollowing-isnt-process-hollowing", "title": "When Process Hollowing Isn’t Process Hollowing", "url": "https://trainsec.net/library/windows-internals/when-process-hollowing-isnt-process-hollowing/", "kind": "trainsec", "evidence_sections": [ "When Process Hollowing Isn’t Process Hollowing by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "installation", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:windows-logon-sessions-and-tokens", "title": "What Are Windows Logon Sessions and How Do They Relate to Tokens?", "url": "https://trainsec.net/library/windows-internals/windows-logon-sessions-and-tokens/", "kind": "trainsec", "evidence_sections": [ "What Are Windows Logon Sessions and How Do They Relate to Tokens? by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:windows-management-instrumentation-wmi", "title": "Introduction to Windows Management Instrumentation (WMI)", "url": "https://trainsec.net/library/windows-internals/windows-management-instrumentation-wmi/", "kind": "trainsec", "evidence_sections": [ "Introduction to Windows Management Instrumentation (WMI) by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:windows-privileges-sedebugprivilege", "title": "Windows Privileges Explained: SeDebugPrivilege and AdjustTokenPrivileges in C++", "url": "https://trainsec.net/library/windows-internals/windows-privileges-sedebugprivilege/", "kind": "trainsec", "evidence_sections": [ "Windows Privileges Explained: SeDebugPrivilege and AdjustTokenPrivileges in C++ by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:windows-subsystem-for-linux", "title": "How does Windows Subsystem for Linux (Version 1) actually work?", "url": "https://trainsec.net/library/windows-internals/windows-subsystem-for-linux/", "kind": "trainsec", "evidence_sections": [ "How does Windows Subsystem for Linux (Version 1) actually work? by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:windows-tls-thread-local-storage-explained", "title": "Windows TLS (Thread-Local Storage) Explained", "url": "https://trainsec.net/library/windows-internals/windows-tls-thread-local-storage-explained/", "kind": "trainsec", "evidence_sections": [ "Windows TLS (Thread-Local Storage) Explained by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:write-windbg-extensions", "title": "Writing a WinDbg Extension: Streamline Your Debugging Workflow", "url": "https://trainsec.net/library/windows-internals/write-windbg-extensions/", "kind": "trainsec", "evidence_sections": [ "Writing a WinDbg Extension: Streamline Your Debugging Workflow by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-internals:writing-a-simple-key-logger", "title": "Writing a Simple Key Logger", "url": "https://trainsec.net/library/windows-internals/writing-a-simple-key-logger/", "kind": "trainsec", "evidence_sections": [ "Writing a Simple Key Logger by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "actions-on-objectives", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the credential, data-access, collection, or impact sections to reason about the intended outcome and defensive evidence.", "read_sections": [] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:writing-a-windows-service", "title": "Writing a Windows Service", "url": "https://trainsec.net/library/windows-internals/writing-a-windows-service/", "kind": "trainsec", "evidence_sections": [ "Writing a Windows Service by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "installation", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the implant, loader, host-artifact, or persistence analysis to investigate establishment of a foothold.", "read_sections": [ "Defining the Service Table", "Main Service Function and Control Handler" ] } ], "author": "Pavel Yosifovich" }, { "id": "trainsec-net:library:windows-internals:writing-control-panel-applications", "title": "Writing Control Panel Applications", "url": "https://trainsec.net/library/windows-internals/writing-control-panel-applications/", "kind": "trainsec", "evidence_sections": [ "Writing Control Panel Applications by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-kernel:launch-wsl-applications-from-windows-with-wsllaunch", "title": "Launch WSL Applications from Windows with WslLaunch", "url": "https://trainsec.net/library/windows-kernel/launch-wsl-applications-from-windows-with-wsllaunch/", "kind": "trainsec", "evidence_sections": [ "Launch WSL Applications from Windows with WslLaunch by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-kernel:linked-lists-in-the-windows-kernel", "title": "Linked Lists in the Windows Kernel", "url": "https://trainsec.net/library/windows-kernel/linked-lists-in-the-windows-kernel/", "kind": "trainsec", "evidence_sections": [ "Linked Lists in the Windows Kernel by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [], "exclusion_reason": "General internals, debugging, or development background without direct stage-specific instruction; available in the attributed TrainSec Library." }, { "id": "trainsec-net:library:windows-kernel:windows-shell-links-in-c-how-to-read-and-write-lnk-files", "title": "Windows Shell Links in C++: How to Read and Write .lnk Files", "url": "https://trainsec.net/library/windows-kernel/windows-shell-links-in-c-how-to-read-and-write-lnk-files/", "kind": "trainsec", "evidence_sections": [ "Windows Shell Links in C++: How to Read and Write .lnk Files by Pavel Yosifovich, republished from TrainSec.net with permission." ], "placements": [ { "stage": "delivery", "note": "By Pavel Yosifovich. Attributed TrainSec technical background: Use the documented entry route or distribution mechanism to connect the arriving artifact to subsequent activity.", "read_sections": [] } ], "author": "Pavel Yosifovich" }, { "id": "site:adversarygraph-docs:case-studies-validation", "title": "Case Studies And Validation Examples", "url": "https://1200km.com/adversarygraph-docs/case-studies-validation/", "kind": "context", "evidence_sections": [ "Case Studies And Validation Examples. Case Studies And Validation Examples. These examples show how to validate AdversaryGraph workflows using screenshots…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:defense-detection-content-from-intel", "title": "Defense: Create Detection Content From CTI", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-detection-content-from-intel/", "kind": "context", "evidence_sections": [ "Defense: Create Detection Content From CTI. Defense: Create Detection Content From CTI. Practical security guidance with scope, evidence, and validation…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:defense-executive-risk-coverage-report", "title": "Defense: Executive Risk And Coverage Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-executive-risk-coverage-report/", "kind": "context", "evidence_sections": [ "Defense: Executive Risk And Coverage Report. Defense: Executive Risk And Coverage Report. Practical security guidance with scope, evidence, and validation…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:defense-ioc-enrichment-pipeline", "title": "Defense: Build IOC Enrichment Pipeline", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-ioc-enrichment-pipeline/", "kind": "context", "evidence_sections": [ "Defense: Build IOC Enrichment Pipeline. Defense: Build IOC Enrichment Pipeline. Practical security guidance with scope, evidence, and validation boundaries." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:defense-mitre-coverage-baseline", "title": "Defense: Build MITRE Coverage Baseline", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-mitre-coverage-baseline/", "kind": "context", "evidence_sections": [ "Defense: Build MITRE Coverage Baseline. Defense: Build MITRE Coverage Baseline. Practical security guidance with scope, evidence, and validation boundaries." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:defense-sector-detection-roadmap", "title": "Defense: Create Sector-Based Detection Roadmap", "url": "https://1200km.com/adversarygraph-docs/use-cases/defense-sector-detection-roadmap/", "kind": "context", "evidence_sections": [ "Defense: Create Sector-Based Detection Roadmap. Defense: Create Sector-Based Detection Roadmap. Practical security guidance with scope, evidence, and…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:intermediate-build-sector-brief", "title": "Build A Sector Threat Brief", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-build-sector-brief/", "kind": "context", "evidence_sections": [ "Build A Sector Threat Brief. Build A Sector Threat Brief. Build Sector Threat Brief workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:intermediate-compare-incident-to-actors", "title": "Compare Incident TTPs To Actors", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-compare-incident-to-actors/", "kind": "context", "evidence_sections": [ "Compare Incident TTPs To Actors. Compare Incident TTPs To Actors. Compare Incident TTPs to Actors workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:intermediate-compare-two-reports", "title": "Compare Two Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-compare-two-reports/", "kind": "context", "evidence_sections": [ "Compare Two Reports. Compare Two Reports. Compare Two Reports workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:intermediate-enrich-actor-iocs", "title": "Enrich Actor IOCs", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-enrich-actor-iocs/", "kind": "context", "evidence_sections": [ "Enrich Actor IOCs. Enrich Actor IOCs. Enrich Actor IOCs workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:intermediate-import-misp-json", "title": "Import MISP JSON", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-import-misp-json/", "kind": "context", "evidence_sections": [ "Import MISP JSON. Import MISP JSON. Import MISP JSON workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:intermediate-map-report-to-attack", "title": "Map A Report To ATT&CK", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-map-report-to-attack/", "kind": "context", "evidence_sections": [ "Map A Report To ATT&CK. Map A Report To ATT&CK. Map Report to ATT&CK workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:intermediate-pull-taxii-stix", "title": "Pull TAXII Or Import STIX", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-pull-taxii-stix/", "kind": "context", "evidence_sections": [ "Pull TAXII Or Import STIX. Pull TAXII Or Import STIX. Practical security guidance with scope, evidence, and validation boundaries." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:intermediate-review-coverage-gap", "title": "Review One Coverage Gap", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-review-coverage-gap/", "kind": "context", "evidence_sections": [ "Review One Coverage Gap. Review One Coverage Gap. Practical security guidance with scope, evidence, and validation boundaries." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:intermediate-sync-yara-sigma", "title": "Sync YARA And Sigma Feeds", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-sync-yara-sigma/", "kind": "context", "evidence_sections": [ "Sync YARA And Sigma Feeds. Sync YARA And Sigma Feeds. Practical security guidance with scope, evidence, and validation boundaries." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:intermediate-use-local-llm", "title": "Use A Local LLM For Private Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/intermediate-use-local-llm/", "kind": "context", "evidence_sections": [ "Use A Local LLM For Private Reports. Use A Local LLM For Private Reports. Practical security guidance with scope, evidence, and validation boundaries." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:investigation-apt-campaign-cluster", "title": "Investigation: Cluster Multiple APT Reports", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-apt-campaign-cluster/", "kind": "context", "evidence_sections": [ "Investigation: Cluster Multiple APT Reports. Investigation: Cluster Multiple APT Reports. Practical security guidance with scope, evidence, and validation…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:investigation-cloud-incident", "title": "Investigation: Cloud And Kubernetes Incident", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-cloud-incident/", "kind": "context", "evidence_sections": [ "Investigation: Cloud And Kubernetes Incident. Investigation: Cloud And Kubernetes Incident. Practical security guidance with scope, evidence, and validation…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:investigation-malware-family", "title": "Investigation: Malware Family Behavior Mapping", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-malware-family/", "kind": "context", "evidence_sections": [ "Investigation: Malware Family Behavior Mapping. Investigation: Malware Family Behavior Mapping. Practical security guidance with scope, evidence, and…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:investigation-ransomware-intrusion", "title": "Investigation: From Log To Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-ransomware-intrusion/", "kind": "context", "evidence_sections": [ "Investigation: From Log To Report. Investigation: From Log To Report. Practical security guidance with scope, evidence, and validation boundaries." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:investigation-third-party-report-validation", "title": "Investigation: Validate A Third-Party CTI Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/investigation-third-party-report-validation/", "kind": "context", "evidence_sections": [ "Investigation: Validate A Third-Party CTI Report. Investigation: Validate A Third-Party CTI Report. Practical security guidance with scope, evidence, and…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:simple-add-custom-ioc-feed", "title": "Add A Custom IOC Feed", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-add-custom-ioc-feed/", "kind": "context", "evidence_sections": [ "Add A Custom IOC Feed. Add A Custom IOC Feed. Add Custom IOC Feed workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:simple-check-an-ioc", "title": "Check One IOC", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-check-an-ioc/", "kind": "context", "evidence_sections": [ "Check One IOC. Check One IOC. Check One IOC workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:simple-export-pdf-report", "title": "Export A PDF Report", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-export-pdf-report/", "kind": "context", "evidence_sections": [ "Export A PDF Report. Export A PDF Report. Export PDF Report workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:simple-import-navigator-layer", "title": "Import A Navigator Layer", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-import-navigator-layer/", "kind": "context", "evidence_sections": [ "Import A Navigator Layer. Import A Navigator Layer. Import Navigator Layer workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:simple-open-actor-profile", "title": "Open One Actor Profile", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-open-actor-profile/", "kind": "context", "evidence_sections": [ "Open One Actor Profile. Open One Actor Profile. Open Actor Profile workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:simple-open-troubleshooting", "title": "Open Troubleshooting For An Error", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-open-troubleshooting/", "kind": "context", "evidence_sections": [ "Open Troubleshooting For An Error. Open Troubleshooting For An Error. Practical security guidance with scope, evidence, and validation boundaries." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:simple-run-selftest", "title": "Run Deployment Selftest", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-run-selftest/", "kind": "context", "evidence_sections": [ "Run Deployment Selftest. Run Deployment Selftest. Run Deployment Selftest workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:simple-search-ioc-library", "title": "Search The IOC Library", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-search-ioc-library/", "kind": "context", "evidence_sections": [ "Search The IOC Library. Search The IOC Library. Search IOC Library workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:simple-show-actor-on-matrix", "title": "Show Actor TTPs On The Matrix", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-show-actor-on-matrix/", "kind": "context", "evidence_sections": [ "Show Actor TTPs On The Matrix. Show Actor TTPs On The Matrix. Show Actor TTPs on Matrix workflow" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-docs:use-cases:simple-sync-threatfox", "title": "Sync ThreatFox IOCs", "url": "https://1200km.com/adversarygraph-docs/use-cases/simple-sync-threatfox/", "kind": "context", "evidence_sections": [ "Sync ThreatFox IOCs. Sync ThreatFox IOCs. Practical security guidance with scope, evidence, and validation boundaries." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph-web-guide.html", "title": "Threat Matrix", "url": "https://1200km.com/adversarygraph-web-guide.html", "kind": "context", "evidence_sections": [ "Threat Matrix. Guide to Threat Matrix: browser-native ATT&CK matrices, group library, TTP overlap scoring, group comparison, coverage…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph:full-version-feature-guides.html", "title": "AdversaryGraph Full-Version Guide — 31 Modules and Use Cases", "url": "https://1200km.com/adversarygraph/full-version-feature-guides.html", "kind": "context", "evidence_sections": [ "Detailed single-column guide to all 31 governed AdversaryGraph workspaces with prerequisites, step-by-step workflows, outputs, worked use cases, acceptance evidence, screenshots, and explicit source-versus-published release boundaries." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:adversarygraph:use-cases.html", "title": "Use Cases for AI-Assisted CTI, Malware Analysis, ATT&CK Mapping, IOC Investigation, and Detection Handoff", "url": "https://1200km.com/adversarygraph/use-cases.html", "kind": "context", "evidence_sections": [ "Use Cases for AI-Assisted CTI, Malware Analysis, ATT&CK Mapping, IOC Investigation, and Detection Handoff. Use Cases for AI-Assisted CTI, Malware Analysis…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-attack-statistics", "title": "AI in Cyberattacks: A Statistical CTI Study of 111 Publications", "url": "https://1200km.com/ai-attack-statistics/", "kind": "context", "evidence_sections": [ "Analyze 111 publications and 103 eligible CTI records mapping attacker use of AI, evidence strength, research limits, datasets, and reproducible methods." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course.html", "title": "AI Security Engineering", "url": "https://1200km.com/ai-security-course.html", "kind": "context", "evidence_sections": [ "A market-informed, evidence-grounded AI security engineering course covering complete AI systems, adversarial ML, RAG, agents, MCP, detection, DFIR, and governance. Under construction." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course:glossary.html", "title": "AI, ML & LLM Glossary", "url": "https://1200km.com/ai-security-course/glossary.html", "kind": "context", "evidence_sections": [ "The canonical AI, machine learning, LLM, RAG, agent, MLOps, evaluation, and AI-security terminology used in the AI Security Engineering course." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course:module-00-instructor.html", "title": "Instructor Guide", "url": "https://1200km.com/ai-security-course/module-00-instructor.html", "kind": "context", "evidence_sections": [ "Instructor runbook and assessment guidance for AI Security Engineering Module 00." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course:module-00-workbook.html", "title": "AI, ML & LLM Foundations Workbook", "url": "https://1200km.com/ai-security-course/module-00-workbook.html", "kind": "context", "evidence_sections": [ "Printable learner workbook for Module 00: AI, ML, and LLM Foundations." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course:module-00.html", "title": "AI, Machine Learning & LLM Foundations", "url": "https://1200km.com/ai-security-course/module-00.html", "kind": "context", "evidence_sections": [ "The complete technical foundation for AI Security Engineering: AI, ML, neural networks, Transformers, LLMs, RAG, agents, MCP, evaluation, MLOps, and canonical terminology." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course:module-00:chapter-01.html", "title": "AI Security Course, Module 00 — Part 1: Introduction, AI/ML Taxonomy, and Data Foundations", "url": "https://1200km.com/ai-security-course/module-00/chapter-01.html", "kind": "context", "evidence_sections": [ "AI Security Course Module 00 Part 1: AI and ML taxonomy, symbolic rules, deep learning, generative AI, foundation models, LLMs, security cases, and data foundations." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course:module-00:chapter-02.html", "title": "How Learning Systems Use Data", "url": "https://1200km.com/ai-security-course/module-00/chapter-02.html", "kind": "context", "evidence_sections": [ "AI Security Course Module 00 Chapter 2: data, features, labels, parameters, hyperparameters, training, validation, testing, inference, and CTI evidence." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course:module-00:chapter-03.html", "title": "AI Security Course, Module 00 — Chapter 3: Neural Networks and Optimization", "url": "https://1200km.com/ai-security-course/module-00/chapter-03.html", "kind": "context", "evidence_sections": [ "Neural-network computation, optimization, reproducibility, attacker access, adversarial examples, robustness, poisoning, backdoors, inference attacks, and defensible AI-security evidence." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course:module-00:chapter-04.html", "title": "AI Security Course, Module 00 — Chapter 4: Transformers and LLM Generation", "url": "https://1200km.com/ai-security-course/module-00/chapter-04.html", "kind": "context", "evidence_sections": [ "Trace LLM requests through tokenization, chat templates, attention, decoding, prompt injection, deterministic controls, and reproducible evidence." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course:module-01-instructor.html", "title": "Instructor Guide", "url": "https://1200km.com/ai-security-course/module-01-instructor.html", "kind": "context", "evidence_sections": [ "Instructor runbook and assessment guidance for AI Security Engineering Module 1." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course:module-01-workbook.html", "title": "Learner Workbook", "url": "https://1200km.com/ai-security-course/module-01-workbook.html", "kind": "context", "evidence_sections": [ "Printable learner workbook for Module 1: AI Security Threat Landscape." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:ai-security-course:module-01.html", "title": "AI Security Threat Landscape", "url": "https://1200km.com/ai-security-course/module-01.html", "kind": "context", "evidence_sections": [ "Module 1 of AI Security Engineering: real incidents, threat reports, vulnerabilities, malicious artifacts, and reproducible AI-security research." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:articles:adversarygraph-from-log-to-report-ioc-investigation.html", "title": "From Log to Report: Using AdversaryGraph to Turn Firewall and EDR Noise Into a CTI Investigation", "url": "https://1200km.com/articles/adversarygraph-from-log-to-report-ioc-investigation.html", "kind": "context", "evidence_sections": [ "From Log to Report: Using AdversaryGraph to Turn Firewall and EDR Noise Into a CTI Investigation. From Log to Report: Using AdversaryGraph to Turn Firewall…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:cyber-knowledge:cti.html", "title": "Cyber Threat Intelligence (CTI)", "url": "https://1200km.com/cyber-knowledge/cti.html", "kind": "context", "evidence_sections": [ "Source-linked CTI field guide covering intelligence requirements, collection, analysis, ATT&CK, actor research, sharing, hunting, and detection." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:cyber-knowledge:grc.html", "title": "Governance, Risk & Compliance (GRC)", "url": "https://1200km.com/cyber-knowledge/grc.html", "kind": "context", "evidence_sections": [ "Cybersecurity GRC guide covering governance, scenario-based risk, NIST CSF 2.0, controls, audit evidence, suppliers, privacy, resilience, and AI." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:itdr", "title": "ITDR", "url": "https://1200km.com/ITDR/", "kind": "context", "evidence_sections": [ "ITDR. ITDR. Protocols, attack techniques, detection engineering, and simulations for identity-centric security." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:itdr:docs:labs:lab-ad-setup", "title": "Active Directory Lab Setup", "url": "https://1200km.com/ITDR/docs/labs/lab-ad-setup/", "kind": "context", "evidence_sections": [ "Active Directory Lab Setup. Active Directory Lab Setup. Build an AD lab with Domain Controller, workstation, ADCS, vulnerable configurations, and logging." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:itdr:docs:labs:lab-architecture", "title": "Lab Architecture", "url": "https://1200km.com/ITDR/docs/labs/lab-architecture/", "kind": "context", "evidence_sections": [ "Lab Architecture. Lab Architecture. ITDR lab environment design — topology, components, tooling, and what each lab enables." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:itdr:docs:labs:lab-entra-setup", "title": "Entra ID Lab Setup", "url": "https://1200km.com/ITDR/docs/labs/lab-entra-setup/", "kind": "context", "evidence_sections": [ "Entra ID Lab Setup. Entra ID Lab Setup. Set up an Entra ID lab tenant for cloud identity attack simulation — OAuth, device code, Golden SAML." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:itdr:docs:labs:lab-linux-setup", "title": "Linux Identity Lab Setup", "url": "https://1200km.com/ITDR/docs/labs/lab-linux-setup/", "kind": "context", "evidence_sections": [ "Linux Identity Lab Setup. Linux Identity Lab Setup. Set up a Linux lab with AD integration via SSSD, PAM, Kerberos, and sudo for identity attack practice." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:itdr:docs:labs:lab-okta-setup", "title": "Okta Lab Setup", "url": "https://1200km.com/ITDR/docs/labs/lab-okta-setup/", "kind": "context", "evidence_sections": [ "Okta Lab Setup. Okta Lab Setup. Set up an Okta developer org for MFA fatigue and admin console attack simulation." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:itdr:docs:simulations:scenarios:certificate-escalation", "title": "Scenario: Certificate Escalation", "url": "https://1200km.com/ITDR/docs/simulations/scenarios/certificate-escalation/", "kind": "context", "evidence_sections": [ "Scenario: Certificate Escalation. Scenario: Certificate Escalation. Scaffold — full attack-defense simulation for Certificate Escalation." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:itdr:docs:simulations:scenarios:cloud-identity-takeover", "title": "Scenario: Cloud Identity Takeover", "url": "https://1200km.com/ITDR/docs/simulations/scenarios/cloud-identity-takeover/", "kind": "context", "evidence_sections": [ "Scenario: Cloud Identity Takeover. Scenario: Cloud Identity Takeover. Scaffold — full attack-defense simulation for Cloud Identity Takeover." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:itdr:docs:simulations:scenarios:domain-compromise-chain", "title": "Scenario: Domain Compromise Chain", "url": "https://1200km.com/ITDR/docs/simulations/scenarios/domain-compromise-chain/", "kind": "context", "evidence_sections": [ "Scenario: Domain Compromise Chain. Scenario: Domain Compromise Chain. Full AD compromise simulation — Kerberoasting → Pass-the-Hash → DCSync → Golden Ticket…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:itdr:docs:simulations:scenarios:hybrid-golden-saml", "title": "Scenario: Hybrid Golden Saml", "url": "https://1200km.com/ITDR/docs/simulations/scenarios/hybrid-golden-saml/", "kind": "context", "evidence_sections": [ "Scenario: Hybrid Golden Saml. Scenario: Hybrid Golden Saml. Scaffold — full attack-defense simulation for Hybrid Golden Saml." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:itdr:docs:simulations:simulation-framework", "title": "Attack–Defense Simulation Framework", "url": "https://1200km.com/ITDR/docs/simulations/simulation-framework/", "kind": "context", "evidence_sections": [ "Attack–Defense Simulation Framework. Attack–Defense Simulation Framework. How ITDR simulations are structured — scenario format, lab prerequisites, attacker…" ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:research:adversarygraph-pcap-stories", "title": "Twenty malware PCAPs: reports and evidence", "url": "https://1200km.com/research/adversarygraph-pcap-stories/", "kind": "context", "evidence_sections": [ "Twenty malware PCAP tests with real AdversaryGraph screenshots, short reports, IOC checks, official-answer comparisons, and downloadable evidence." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "site:research:adversarygraph-ten-pcaps", "title": "Ten malware PCAPs: public evidence supplement", "url": "https://1200km.com/research/adversarygraph-ten-pcaps/", "kind": "context", "evidence_sections": [ "Public evidence supplement for ten AdversaryGraph malware-PCAP tests: reports, screenshots, audit records, provenance and limitations." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "github-com:anpa1200:malware-analysis", "title": "Malware_analysis", "url": "https://github.com/anpa1200/Malware_analysis", "kind": "context", "evidence_sections": [ "Historical malware-analysis repository retained for reference and marked archived by GitHub." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." }, { "id": "github-com:anpa1200:networking", "title": "Networking", "url": "https://github.com/anpa1200/Networking", "kind": "context", "evidence_sections": [ "Historical networking repository retained for reference and marked archived by GitHub." ], "placements": [], "exclusion_reason": "Cross-cutting reference, versioned product documentation, infrastructure setup, or general foundations. Use the existing Library and source lifecycle/version notices; no stage-specific placement is asserted." } ] }