Infosec Chaos

Entities to Include in your Hypothesis Creation

Entities to be considered while creating hypothesis for threat hunting OR whilst investigating an attackers action.
Analyst's Problems as a Service (APaaS) - Part 3

In this blog post, we will continue our discussion of Analyst's Problems as a Service (APaaS), if you have not read the previous parts...
Detection through defined (MY) process

A common question among SIEM content/detection creators is “What is the process that needs to be followed to create a detection?” There a...
Analyst's Problems as a Service (APaaS) - Part 2

In this blog we will discuss some of the issues an analyst face due to lack of log and alert enrichment. This is a continuation of a three-...
Analyst's Problems as a Service (APaaS) - Part 1

Our first blog post in the three-part series is on the sections "The usual" and "Architectural". Ever watched the clip ...
Threat Hunting: Decoding User-Agents for better Insights

User-agent analysis is one of the powerful methods in threat hunting to identify unusual behaviors that may indicate malicious activity. Eac...
Analyst's Problems as a Service (APaaS)

There are many blogs and industry experts who have discussed issues of a SIEM, how it can fail, and what it is lacking. I'm worked and...
The Methodology of Threat Hunting Research

Recently, after discussions with folks, I realized there may exist few challenges in threat hunting, especially related to threat hunt res...
A Journey Through Adversary Infra Analysis- Learning to Pivot

Recently Fortinet released an advisory stating two CVEs (CVE-2024–55591 and CVE-2022–40684) were actively exploited in the wild. I started ...
A.P.E.X: Threat Hunting Through Structured Hypothesis Generation

In a laest report I worked on Hunters International ransomware, I provided several hypotheses you can implement in your environment. I wan...