Tag: detection-engineering

All the articles with the tag "detection-engineering".

• The Party Invite That Wasn't: Anatomy of a ScreenConnect Phishing Campaign

  12 Aug, 2026

  A fake e-vite, a compromised sender you actually trust, and a remote access tool that never should have been installed. Six devices, one campaign, and the logical inconsistency that gave it away.

• Today's Special: Juicy Nothing-Burger

  18 May, 2026

  762 sessions. Rotating AWS infrastructure. Dual C2 channels. Jittered intervals specifically designed to defeat statistical detection. On a cafeteria menu board.

• PcClient.bal RAT Outbreak: Six Hosts, After-Hours Beaconing, and a Gap in Egress Policy

  17 Mar, 2026

  A single IDS alert turned into a six-host RAT cluster, all beaconing after hours on non-standard ports. The firewall didn't catch it. The IDS did.