Tagged: Blue Team
6 posts · browse all tags
-
Metasploit Deep Dive Part 10: Network-Level Detection Engineering
What a network monitor can actually see in the meterpreter handshake and default transports, deliberately narrowed to the wire, since host-based detection is a separate series once its lab work lands.
-
Enrichment Has to Come First: Adding IOC Lookups to the n8n Alert Router
Extending the Wazuh-to-chat n8n pipeline with an AbuseIPDB enrichment step ahead of the threshold decision — plus a real, source-level dig into why n8n's workflow static data silently stopped persisting inside the Code node's newer isolated-vm sandbox.
-
Alert Fatigue Is a Routing Problem: A Wazuh-to-Chat Pipeline in n8n
A noisy SIEM is its own security problem — the fix isn't more alerts, it's better routing. Building and testing a Wazuh-to-chat pipeline in n8n, and two real bugs the build itself turned up.
-
BloodHound Deep Dive Part 7: Detecting SharpHound and LDAP-Based ACL Abuse
What SharpHound's own documented collection behavior leaves in the event log, why 4662 volume is the tell, and the defensive case for running BloodHound against your own domain before an attacker's copy does.
-
Sn1per Deep Dive Part 5: What an Automated Sweep Looks Like From the Blue Team's Side
Sn1per's default scan modes fire real, unconditional exploit attempts against old CVEs the instant a banner matches. That's expensive for an attacker to hide and cheap for a defender to detect, and root-verified testing found a genuine defensive win too.
-
AI Pentest Agents Part 6: Fingerprinting the Swarm, a Defender's Read on Agent Noise
PentestCode's own README admits it isn't stealthy and repeats work it's already done. What does that actually look like on the wire, and does it give a defender anything a human red-teamer wouldn't?