nesrine cherrabi
THREAT HUNTER
home / writing
Field notes
Practical writing on threat hunting, incident response, and detection engineering, no vendor spin, no fear-mongering. Just what actually works when you’re defending with a small team.
Attackers increasingly run PowerShell without ever touching powershell.exe, loading the engine straight into other processes to slip past the obvious detections. This piece walks through hunting that unmanaged PowerShell execution in Elastic, with Sigma logic your SOC can put to work.
What Is RedSun? RedSun is an unpatched zero-day Local Privilege Escalation (LPE) exploit that abuses a logic flaw in Microsoft
Scheduled tasks are a normal part of system operations, they help with updates, backups, and maintenance jobs.But attackers love them
When is osquery the right tool for a hunt? This walkthrough takes a command-and-control scenario end to end with Osquery Manager, then turns the findings into reusable detections and YARA-based scanning.
WMI event subscriptions are a favourite persistence trick because they blend into normal Windows activity. Here is how to root them out using Sysmon, the ELK stack, and osquery together.
The outcome of an incident is usually decided long before it happens. This article makes the case for why the preparation phase is the most important part of any incident response strategy, and what being ready actually looks like.