mthcht – Medium

mthcht

Published in
Detect FYI

Threat Hunting - Suspicious Named pipes

Jul 22, 2024

Threat Hunting - Suspicious Named pipes

Jul 22, 2024

Published in
Detect FYI

Event Log Manipulations - Time slipping

After reading Alex’s latest article, I’m inspired to start a detection serie dedicated to Event Log manipulation techniques, with our first…

Jan 13, 2024

Event Log Manipulations - Time slipping

Jan 13, 2024

Get an email whenever mthcht publishes.

By signing up, you will create a Medium account if you don’t already have one. Review our Privacy Policy for more information about our privacy practices.

Medium sent you an email at to complete your subscription.

Published in
Detect FYI

Threat Hunting — Suspicious Windows Service Names

Simulation and Detection

Jan 8, 2024

Threat Hunting — Suspicious Windows Service Names

Jan 8, 2024

Published in
Detect FYI

Threat Hunting - Suspicious User Agents

Hunting for Suspicious User Agents with Splunk

Jan 1, 2024

Threat Hunting - Suspicious User Agents

Jan 1, 2024

Published in
Detect FYI

Detecting DNS over HTTPS

Detecting DNS over HTTPS - DoH with a SIEM - logs analysis

Nov 7, 2023

Detecting DNS over HTTPS

Nov 7, 2023

Published in
Detect FYI

Threat Hunting - Suspicious TLDs

Nov 3, 2023

Threat Hunting - Suspicious TLDs

Nov 3, 2023

Published in
OSINT Team

Catching My Hacker via Leaked Databases

How i got hacked and tracked the hacker with leaked databases

Oct 4, 2023

Catching My Hacker via Leaked Databases

Oct 4, 2023

Published in
Detect FYI

Detect DLL Hijacking techniques from HijackLibs with Splunk

Splunk detections searches

Oct 1, 2023

Detect DLL Hijacking techniques from HijackLibs with Splunk

Oct 1, 2023

The Myths and Realities of VPNs

Have you also noticed the aggressive advertising campaigns for VPN providers, promoted by social media influencers and YouTube creators …

Sep 30, 2023

The Myths and Realities of VPNs

Sep 30, 2023

Published in
Detect FYI

How Threat Actors use Pastebin

Why is it important to monitor paste sites? detection tips

Aug 24, 2023

How Threat Actors use Pastebin

Aug 24, 2023

LOLBAS Detection Serie [2] — Mspub.exe + ProtocolHandler.exe + MsoHtmEd.exe

The LOLBAS serie : https://medium.com/@mthcht/list/lolbas-843ba9de6810

Aug 23, 2023

LOLBAS Detection Serie [2] — Mspub.exe + ProtocolHandler.exe + MsoHtmEd.exe

Aug 23, 2023

Published in
Detect FYI

LOLBAS Detection Serie [1] - AppInstaller.exe

Testing and Detecting LOLBAS techinques

Aug 21, 2023

LOLBAS Detection Serie [1] - AppInstaller.exe

Aug 21, 2023

Published in
Detect FYI

Detecting Phishing attempts with DNSTWIST

DNSTWIST for SOC & CTI

Aug 15, 2023

Detecting Phishing attempts with DNSTWIST

Aug 15, 2023

Published in
Detect FYI

File Integrity Monitoring with Auditd

FIM ? PCI DSS ?

Aug 11, 2023

File Integrity Monitoring with Auditd

Aug 11, 2023

Published in
Detect FYI

How Threat Actors Use GitHub

Introduction

Aug 8, 2023

How Threat Actors Use GitHub

Aug 8, 2023

Threat Hunting - HTTP Requests Without Domain Names

Introduction

Aug 7, 2023

Threat Hunting - HTTP Requests Without Domain Names

Aug 7, 2023

Canary Tokens and Callback URLs: A Double-Edged Sword

Introduction

Aug 7, 2023

Canary Tokens and Callback URLs: A Double-Edged Sword

Aug 7, 2023

Hunting for suspicious ports activities

Using the list of suspicious ports: https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_ports_list.csv (updated regularly)

Aug 7, 2023

Hunting for suspicious ports activities

Aug 7, 2023

Detect Phishing attempts with Wetransfer

ref: https://twitter.com/mthcht/status/1658853848323182597

Aug 7, 2023

Detect Phishing attempts with Wetransfer

Aug 7, 2023

Detecting browser extensions installations

Chrome and Firefox

Aug 7, 2023

Detecting browser extensions installations

Aug 7, 2023

mthcht

mthcht

Threat Hunting - DFIR - Detection Engineering

Following

Lists

log analysis

5 stories2 saves

Threat Intelligence

6 stories2 saves

Threat Hunting

22 stories6 saves

Help
Status
About
Careers
Press
Blog
Privacy
Terms
Text to speech
Teams