Wylie Bayes

Writing static KQL or EQL rules is highly effective for catching known threats (e.g., "Alert me if mimikatz.exe runs"). However, static rules struggle immensely against the "unknown unknowns" or attacks that mimic legitimate behavior. How do you write a static rule for data exfiltration?

When organizations first deploy the Elastic Stack for security, they primarily use it as a SIEM—a giant repository for network logs, firewall traffic, and Windows Event logs. However, Elastic is no longer just a passive observer. With the introduction of Elastic Defend (formerly known as Elastic Endpoint Security/Endgame)

Elastic Security comes with hundreds of pre-built detection rules out-of-the-box, created and maintained by Elastic’s security research team. While these rules provide a fantastic baseline, every corporate environment is unique. A behavioral pattern that is highly malicious in one company might be a standard daily

In previous posts, we discussed the importance of deploying an Intrusion Detection System (IDS) to monitor network traffic. Suricata is arguably the most powerful open-source IDS/IPS engine available today. However, Suricata running on a standalone Linux box isn't very useful to a modern Security Operations Center

When you deploy a SIEM like Elastic Security, the volume of data can be overwhelming. A medium-sized enterprise can easily generate billions of log events per week. For a security analyst, finding a single malicious PowerShell command in that ocean of data is impossible without a fast, intuitive way

The Elastic Stack (formerly ELK—Elasticsearch, Logstash, Kibana) has long been the open-source backbone of log management. In recent years, Elastic has aggressively evolved the platform beyond simple log aggregation, transforming it into a full-fledged Security Information and Event Management (SIEM) and Endpoint Security solution: Elastic Security. Whether

Ten years ago, securing a corporate network was straightforward: you bought the biggest, most expensive firewall you could afford, placed it at the edge of your network, and funneled all traffic through it. Inside the firewall was the trusted zone; outside was the untrusted internet. Today, that model is dead.

Historically, software development and cybersecurity were entirely separate disciplines. Developers wrote the code, operations deployed it, and the security team audited it right before release. When the security team inevitably found critical flaws, the release was delayed, causing massive friction between departments. As organizations adopted Agile methodologies and Continuous Integration/

In traditional cybersecurity, the defender has to be right 100% of the time, but the attacker only has to be right once. This asymmetry is incredibly frustrating for Blue Teams. However, there is one area of defensive cyber operations that flips this paradigm entirely: Deception Technology. When you deploy honeypots,

In the fast-paced world of Agile software development, security is often bolted on at the very end of the cycle—usually after a penetration tester finds a critical flaw a week before the launch date. Fixing architectural flaws at the end of the development lifecycle is incredibly expensive and

The shift from monolithic virtual machines to microservices and containers has revolutionized software development. Containers are lightweight, start in milliseconds, and ensure that an application runs identically on a developer's laptop as it does in the production cloud. However, this agility comes with a new set of security

Deploying a fresh Windows Server straight out of the box and putting it into production is a recipe for disaster. By default, Windows operating systems prioritize compatibility and ease of use over strict security. They come with legacy protocols enabled, unnecessary services running, and broad permissions that attackers can easily

For decades, the standard for endpoint protection was legacy Antivirus (AV). It worked by comparing files against a massive list of known bad signatures. Today, as attackers shift to fileless malware, Living off the Land (LotL) techniques, and zero-day exploits, signature-based AV is effectively obsolete. The modern standard

Historically, the relationship between offensive security (Red Team) and defensive security (Blue Team) has been highly adversarial. The Red Team spends a month sneaking around the network, popping domain controllers, and feeling incredibly smart. At the end of the engagement, they drop a 150-page PDF on the Blue Team&

There is a dangerous misconception in the cybersecurity industry that building a Security Operations Center (SOC) requires a multi-million-dollar budget, a massive wall of glowing monitors, and a 24/7 team of fifty analysts. While that might be true for Fortune 500 enterprises, small-to-medium businesses (SMBs)

Welcome to the Defensive Cyber (Blue Team) section of the blog! Thus far, we have explored how attackers breach networks, evade detection, and move laterally. Now, we shift our focus to the defenders. One of the greatest challenges facing modern Security Operations Centers (SOCs) is alert fatigue. Security Information and

For decades, the languages of choice for malware development were C and C++. They offered unparalleled, low-level access to the Windows API, memory management, and execution speed. However, as Endpoint Detection and Response (EDR) solutions have matured, they have become incredibly adept at analyzing and flagging compiled C/C+

Before a Red Team sends a single phishing email or launches a port scan, they must understand their target. This foundational phase is known as Open Source Intelligence (OSINT). OSINT involves collecting and analyzing publicly available data to map the target's attack surface, identify key personnel, and discover

The SolarWinds Orion breach of 2020 changed the cybersecurity landscape forever. Advanced threat actors realized that hacking a highly secured target directly was inefficient. Instead, it was far easier to hack a less secure third-party vendor, inject a backdoor into their software update process, and let the target voluntarily

When a Red Team achieves a foothold on a corporate workstation, the ultimate prize—the Domain Controller, the customer database, or the financial SWIFT terminal—is rarely sitting on the same machine. To reach their objective, the attacker must traverse the network. This phase of the attack lifecycle is called

Before Windows 10, scripting engines like PowerShell, VBScript, and JavaScript operated as a massive blind spot for security products. An attacker could run a deeply obfuscated, fileless PowerShell script entirely in memory, and the local Antivirus would have absolutely no visibility into what was happening. To close this gap, Microsoft

Gaining Domain Admin privileges in an Active Directory (AD) environment is the primary objective of most Red Team operations. However, getting to the top is only half the battle; staying there is much harder. Once the Blue Team realizes they are under attack, their immediate response is to initiate the

In the early days of hacking, attackers wrote custom malware in C or Assembly, compiled it into an executable, and dropped it directly onto the victim's hard drive. Today, dropping a custom binary onto a modern Windows machine is the fastest way to get caught by an Endpoint

Despite the millions of dollars organizations spend on Next-Generation Firewalls and Endpoint Detection and Response (EDR) solutions, the most reliable way into a corporate network remains the same as it was twenty years ago: asking an employee to open the door for you. Phishing is still the undisputed king

In a Red Team operation, your infrastructure is your lifeline. If you successfully spear-phish a target, execute your payload, and bypass their EDR, all of that effort is wasted if the Blue Team simply blacklists your single Command and Control (C2) IP address. When your server goes dark, the