FIELD NOTES.
Write-ups on detection, forensics, range design, and evidence discipline. No hype, no filler — the same reasoning the Academy curriculum teaches.
- 2026.10.23#212
Extracting credentials from minidump files
Minidumps can contain sensitive credentials. This guide walks through extracting those credentials for legitimate analysis and testing.
credential-securitydigital-forensicsincident-responsewindows12 MIN - 2026.10.22#211
Writing actionable findings for developers
Technical reports are often too vague for developers. Learn to write findings that are clear, concise, and can be acted upon immediately.
reportingsecurity-architecturemethodologyincident-response10 MIN - 2026.10.21#210
Windows ETW: Patching EventWrite vs Kernel Providers
Understanding the nuances of Windows Event Tracing can aid in developing effective detection mechanisms. This piece explores the implications of patching ETWEventWrite versus using Kernel ETW providers.
windowsdetection-engineeringlog-analysismethodology10 MIN - 2026.10.20#209
Windows token manipulation: impersonation and delegation tokens
Understanding the differences between impersonation and delegation tokens is critical for effective offensive tradecraft in Windows environments.
windowsprivilege-escalationlateral-movementred-team12 MIN - 2026.10.19#208
Understanding iptables: How packet filtering chains work
Explore how iptables evaluates rules across chains like PREROUTING and POSTROUTING to filter packets effectively.
networkinglinuxfirewallpacket-filtering10 MIN - 2026.10.18#207
Inside macOS TCC: Exploring database internals and SIP protections
Understanding macOS Transparency, Consent, and Control (TCC) database internals is key for effective threat hunting. This piece dissects database mechanics and SIP's role in security.
threat-huntingmacossecurity-architectureincident-response12 MIN - 2026.10.17#206
WebAuthn and FIDO2 authentication flow: Understanding passkeys
WebAuthn and FIDO2 streamline secure authentication through passkeys, attestation, and signature verification, enhancing user experience and security.
authenticationweb-securitysecurity-architecturemethodology10 MIN - 2026.10.16#205
How NAT reshapes your network understanding
NAT alters your perception of networks by obscuring device identities. Understanding its mechanisms is vital for effective network management.
networkingsecurity-architecturefundamentals10 MIN - 2026.10.15#204
Post-quantum cryptography transition: ML-KEM and ML-DSA algorithms
Exploring ML-KEM and ML-DSA algorithms reveals their potential in a post-quantum cryptography landscape, emphasizing operational trade-offs and considerations.
cryptographysecurity-architecturemethodology10 MIN - 2026.10.14#203
Setting up a high-interaction SSH honeypot with Cowrie
Cowrie enables detailed logging of attacker interactions through SSH, capturing keystrokes and commands. Here’s how to set it up effectively.
security-labssshhoneypotincident-response12 MIN