Lloyd Sato Open a channel

Case files

Every file follows the same five beats: briefing, threat model, method, findings, impact. Compare the work across domains rather than taking it on trust.

All case files

Domain
MITRE ATT&CK techniques mapped across three malware families

Defense evasion, 9 of 30

CF-001Malware research

Decoding malicious camouflage

How three malware families slip past AMSI and EDR, dissected in an isolated lab and mapped to 30 MITRE ATT&CK techniques.

  • Any.Run
  • REMnux
  • T1562.001
Open file
Techniques observed per ATT&CK tactic, gaps ranked

Defense evasion, 9 techniques

CF-002Detection engineering

Mapping detections to ATT&CK coverage

Turning observed adversary behaviour into a technique coverage map, then using the gaps to decide which detections to build next.

  • MITRE ATT&CK
  • Splunk
  • Defender
Open file
Stages, identified through to closed or accepted

Stage 04, the threat-intelligence overlay

CF-003Vulnerability management

Risk-led triage across an enterprise estate

Prioritising vulnerabilities with CVSS and threat-intelligence-led criteria, then driving remediation to closure with the teams that own the fix.

  • CVSS
  • Nessus
  • Risk acceptance
Open file

Open a channel