Incidents

From Exposed SSH to AWS Root: Anatomy of a Hybrid Breach

A five-stage walkthrough of a plausible hybrid Linux/Windows/AWS compromise, stage by stage, mapped to the real detection rules in the catalogue that would have caught each step.

5 rules referenced

Phishing to Account Takeover: Who Would Your Plan Have Saved?

A password-expiry phishing campaign against 8 recipients, traced from delivery to a malicious inbox rule — with an interactive kill chain where you build the detection and response plan and watch the triage table recompute.

4 rules referenced

Exposed Service to Domain-Wide Ransomware: 19 Days of Warnings

An internet-facing message broker is exploited and, 19 days later, the backups are encrypted first. An interactive kill chain where you build the detection and response plan and watch which hosts survive it — modelled on a public DFIR Report case.

11 rules referenced