Topology Beats Noise: Entity-Centric Detection of SSLVPN Abuse
Building an entity-centric ES|QL hunting model for SSLVPN abuse by prioritizing topology over raw alert volume.
Topic
threat hunting
5 posts from the blog archive.
2026
2025
SSLVPN Honeypots: Fortigate Findings & Musings
Examining patterns observed in operating and collecting data from an SSLVPN honeypot sitting behind a Finch proxy.
Digging Tunnels - Hunting Adversarial Cloudflared Instances
Ransomware affiliates have long since abused Cloudflared tunnels to maintain persistent access to compromised environments.
2024
Chainsaw Hunt & Rules
Chainsaw's hunt feature, along with Chainsaw's rule engine, is an excellent way to hunt for evil at scale and create reusable, maintainable queries for rapid triage.
Chainsaw Search
A brief introduction to Chainsaw's search feature and the document tagging engine, Tau, that WithSecure released in the most recent major Chainsaw update.