Malware analysis, detection engineering and vulnerability work. Most of this shipped as Logpoint’s Emerging Threats series: a written analysis plus a report carrying the detection rules and mitigation guidance.
I led the research function that produced this work. The posts carry their authors’ bylines, not mine, and each entry below says whose.
Entries: 3
A breakdown of the AgentTesla infostealer's capabilities, its delivery through phishing attachments, and the detection logic that catches it.
March 2023
How attackers moved to OneNote attachments to deliver remote access trojans and infostealers after macro execution was restricted.
2023
Original link not recovered
An Emerging Threats report on Quakbot, covering its behaviour, the detection rules that surface it, and mitigation guidance.
September 2022
Entries: 1
An Outlook elevation-of-privilege flaw that leaks NTLM credentials to an attacker-controlled host with no user interaction.
March 2023
Original link not recovered
Entries: 1
Hunting queries, preventive controls and response steps for IcedID Beacon activity.
Date not recovered
Entries marked ‘Original link not recovered’ have no surviving URL. Those posts predate the move from Logpoint to Guardsix and their original addresses were not recovered after it. Nothing has been substituted: the gap is stated and left open rather than filled with a replacement link.
Everything above is the 10%. The other 90% is the people who run the controls, read the queue and decide what gets bypassed, and that half is not settled by another analysis or another product.