/en/tags/mitre-attack/Recent content in Mitre-Attack on Suspicious BytesHugoen-USSat, 30 May 2026 00:00:00 +0000/en/posts/detecting-lateral-movement/Sat, 30 May 2026 00:00:00 +0000/en/posts/detecting-lateral-movement/<p>Once an attacker has a foothold, the interesting part begins: moving from the first host toward whatever they actually came for. That east-west movement leaves traces if you know which events to join.</p> <h2 id="signals-worth-joining">Signals worth joining</h2> <p>Lateral movement rarely shows up as a single smoking-gun event. It emerges from correlation:</p> <ol> <li>Network logon events (<code>4624</code> type 3) from unusual sources</li> <li>Service or scheduled-task creation on the destination</li> <li>Remote process creation shortly after</li> </ol> <blockquote> <p>Correlate across hosts, not just within one. A single <code>4624</code> is noise; a chain of them following an account around the estate is a story.</p>/en/posts/building-a-threat-actor-profile/Fri, 24 Apr 2026 00:00:00 +0000/en/posts/building-a-threat-actor-profile/<p>Cyber threat intelligence is only useful when it changes a decision. A good actor profile turns scattered observations into something a defender can act on this week, not just read.</p> <h2 id="structure-beats-prose">Structure beats prose</h2> <p>A profile that reads like a story is hard to operationalise. Capture it as structured fields instead:</p> <ul> <li>Aliases and overlapping clusters</li> <li>Targeted sectors and regions</li> <li>Observed techniques (mapped to ATT&amp;CK)</li> <li>Known infrastructure patterns</li> </ul> <blockquote> <p>Intelligence without a confidence level is just a rumour with good formatting. State what you know, how well you know it, and how you&rsquo;d be proven wrong.</p>