Infosec Chaos

Entities to Include in your Hypothesis Creation

Entities to be considered while creating hypothesis for threat hunting OR whilst investigating an attackers action.
Analyst's Problems as a Service (APaaS) - Part 3

In this blog post, we will continue our discussion of Analyst's Problems as a Service (APaaS), if you have not read the previous parts...
Analyst's Problems as a Service (APaaS) - Part 1

Our first blog post in the three-part series is on the sections "The usual" and "Architectural". Ever watched the clip ...
Analyst's Problems as a Service (APaaS) - Part 2

In this blog we will discuss some of the issues an analyst face due to lack of log and alert enrichment. This is a continuation of a three-...
Detection through defined (MY) process

A common question among SIEM content/detection creators is “What is the process that needs to be followed to create a detection?” There a...
Analyst's Problems as a Service (APaaS)

There are many blogs and industry experts who have discussed issues of a SIEM, how it can fail, and what it is lacking. I'm worked and...
Threat Hunting: Decoding User-Agents for better Insights

User-agent analysis is one of the powerful methods in threat hunting to identify unusual behaviors that may indicate malicious activity. Eac...
The Methodology of Threat Hunting Research

Recently, after discussions with folks, I realized there may exist few challenges in threat hunting, especially related to threat hunt res...
A Journey Through Adversary Infra Analysis- Learning to Pivot

Recently Fortinet released an advisory stating two CVEs (CVE-2024–55591 and CVE-2022–40684) were actively exploited in the wild. I started ...
A.P.E.X: Threat Hunting Through Structured Hypothesis Generation

In a laest report I worked on Hunters International ransomware, I provided several hypotheses you can implement in your environment. I wan...