A canary token is a decoy with a single job: raise an alert the moment someone touches it. Zero false positives by construction, near-zero cost. What it actually catches, where to plant it, and its blind spots.
Read moreA honeypot is an excellent sensor and a poor defense. Low vs high interaction, honeytokens in AD, pivot and liability risk: what you get out of it, and on what conditions.
Read moreAnonymity isn't a product, it's a compartmentalization discipline. Threat model, identifiers as join keys, Monero before Bitcoin, Tor, no-KYC eSIM, cash and an address that isn't yours.
Read moreModern malware rarely reinvents its container: it reaches into the 1990s. Under-parsed formats, trusted binaries, Mark-of-the-Web gaps — why old formats remain the best vehicle, and how to close those doors.
Read moreDNS is still the C2 channel of choice. Wrapping it in TLS does not create the technique, it removes your ability to see it. What DoT actually changes, and why the answer is first an egress policy.
Read moreWSL2 runs a real Linux in a small VM on the Windows host. What happens inside escapes Sysmon, the Windows logs and many EDRs. Why it is a quiet vector, and how to close the blind spot.
Read moresystemd's swiss-army introspection tool: critical-chain for boot, verify for linting, and above all systemd-analyze security — the hardening checklist generated per service, with its score and its traps.
Read moreNot a syntax course: the mental model, the quoting that breaks everything, the expansions, and the moves that make you fluent. Plus a door to the internals, portability and security.
Read moreThe difference that changes everything: it moves objects, not text. Finding your way, filtering, shaping, the Format-* trap, remoting — and an opening toward the .NET language and defensive logging.
Read moreiptables has been in compatibility mode for years. nftables does the same in one tool, one atomic ruleset, native sets. Here is the migration in practice.
Read moreTOTP, push, SMS: all defeated by an Evilginx-style phishing proxy in 2026. The only MFA that holds is origin-bound: FIDO2, passkeys, certificates.
Read moreThe reverse shell is the first post-exploitation move. Eight variants (bash, python, nc, socat, PHP, PowerShell…) and, for each, the signal that gives it away on defense.
Read moreDisk at 100%, services falling over, and the culprit isn't always the obvious one. The method: find it, free space without breaking things, stop it recurring.
Read moreGPG carries thirty years of complexity, web of trust and formats. To encrypt a file, a backup or a secret between humans, age does the job in one command and one readable key.
Read moresystemd ships a full sandbox almost nobody enables. Fourteen directives, a systemd-analyze security score, and most of your services run with no spare capabilities or disk access.
Read more