My last two posts were about building detections faster. The first covered getting a language model to write queries that match your real telemetry instead of its imagination. The second covered packaging the whole workflow as a coding-agent plugin, so every rule goes through the same gates from draft…
Ask three detection engineers on the same team to build the same rule. You get three different rules. Nobody is wrong. The process is unwritten, so each person runs their own version of it. One checks for a duplicate rule first, one does not. One baselines the volume over 30…
Give a language model this prompt: Write me a query to find suspicious PowerShell in our SIEM. You get a query. The query has correct syntax. It has field names that look like your field names. It runs. It returns nothing. You now have a problem that does not exist…
The premise in one line: attacker tooling rotates constantly, but the control-plane moves don't. When someone lands in a cloud account with a stolen credential, the platform gives them a finite set of API calls to reach any given outcome. Those calls are the chokepoints. Anchor a…
The blogpost below is LLM generated summary of the notes and screenshots of my environment taken while working on the CyberDefenders SignalHunt 2026 CTF, which my team consisting of my collegues @0xEnleak and Pedro landed at 4th place. As the challenges are down, I don't have notes for…
You've gained access to a container running some infrastructure automation. A cron job executes Terraform every minute to keep certificates fresh. The flag is stored in a privileged user's home directory - but you're just a regular user with no direct access. Can you find…
You've gained access to a pod in the staging environment. To beat this challenge, you'll have to spread throughout the cluster and escalate privileges. Can you reach the flag? Good luck! Kubernetes environment, goal is to get details in the kube-system. We can start by…
We have got intelligence that one our developers at Ack-Me Corp is working on a weekend side-project where he is vibe coding an internal knowledge-base chatbot for our company, where he put all of our customer records and sensitive data inside it. Your mission, if you choose…
