Blog
Read
Long-form write-ups, the vulnerabilities that cost the industry most, and a live wire of what's landing today.
Write-ups
-
PurpleForest, Part 1: Building an AD Purple-Team Lab from Zero
Stand up a Windows domain, a Graylog SIEM and Sysmon + Vector telemetry on one Windows host with VMware Workstation, Vagrant and Ansible.
purple-teamactive-directorydetection-engineeringgraylogvectorsysmonansiblevagranthomelab
-
PurpleForest: An Active Directory Lab That Fights Back
Most AD labs teach one half of the job. PurpleForest builds both: a Windows domain to attack, full telemetry through Vector, and Graylog to catch you. Run the attack, read the logs, write the rule, watch it fire, then evade it.
active-directorypurple-teamhomelabdetection-engineeringsiemgraylogvectorsigma
Vulnerabilities that mattered
The bugs that reshaped the industry — what they were, why they worked, and what they cost — are taken apart one at a time in the CVE library.
9 write-upsField Guide
Every tool and idea the write-ups lean on, explained once: what it is, why I use it, what it costs you, and the gotchas I hit along the way.
22 entries