NexurAI
50 practical, no-fluff guides on detection engineering, SOC triage, threat hunting, cloud, DFIR and AI security. Free to read - then practice what you learn in the labs.
50 guides
Sigma is the vendor-agnostic language of detection engineering. Learn the anatomy of a rule - logsource, detection, selections and condition - and write your first one.
Read guideEncoded PowerShell is a favorite of maldocs and living-off-the-land attacks. Here's why it's suspicious, how to decode it, and how to detect it reliably.
Read guideTwo successful logins from far-apart locations minutes apart is a classic account-takeover signal. Here's how a SOC analyst triages it, step by step.
Read guideATT&CK is the shared language of modern defense. Learn what tactics, techniques and sub-techniques are, and how to use ATT&CK to measure your detection coverage.
Read guideAny domain user can request service tickets and crack them offline for service-account passwords. Here's how Kerberoasting works and the detections that catch it.
Read guideAs teams wire LLMs into agents and RAG pipelines, prompt injection has become the new SSRF. Learn the attack, why it's hard to fix, and the defenses that actually help.
Read guideThe SOC analyst is the frontline defender of every organization. Here's what the job really involves, the skills that matter, and how to break in.
Read guideFour alerts land at once and you can only work one first. Here's the mental model SOC analysts use to triage fast without missing the one that matters.
Read guideAttackers increasingly skip malware and abuse trusted, signed Windows binaries. Here's why LOLBins evade signature checks and how to catch them on behavior.
Read guideWindows logs are a firehose. Here are the specific Event IDs that actually matter for detection and DFIR - logons, process creation, services and log tampering.
Read guideCloud breaches increasingly start with a leaked key and escalate through IAM. Here's the attack path and the CloudTrail events that catch it.
Read guideA user forwards a suspicious email. Here's how to read the headers, spot the spoof, and scope a Business Email Compromise step by step.
Read guideThreat hunting is proactively looking for attackers your alerts missed. Here's the hypothesis-driven loop and how a good hunt becomes a permanent detection.
Read guideWhen it's already on fire, a repeatable process keeps you fast and calm. Here's the NIST / SANS PICERL incident-response lifecycle, stage by stage.
Read guideEvery detection lives on a dial between too noisy and too blind. Understand precision, recall and F1 - and how to tune a rule that a SOC will actually trust.
Read guideRansomware rarely encrypts first. Learn the precursor steps crews take before detonation - and the containment calls that stop encryption before it starts.
Read guideDNS is almost always allowed out - so attackers smuggle data and C2 through it. Here's how DNS tunneling works and the metrics that catch it.
Read guideContainers aren't a security boundary by default. Learn the common escape paths - privileged containers, mounted sockets, host mounts - and how to lock them down.
Read guideOperational Technology runs the physical world - and speaks protocols with little authentication. Here's why IT-to-OT crossover is dangerous and how to monitor it.
Read guideSome malware never touches disk. Memory forensics recovers what's only in RAM - injected code, hidden processes, network connections. Here's the workflow.
Read guideJSON Web Tokens are everywhere in modern auth - and full of footguns. Learn the classic attacks (alg=none, weak secrets, confusion) and how to shut them down.
Read guideCommand-and-control implants 'phone home' on a schedule. Learn to spot beaconing by its rhythm - even when the traffic is encrypted and jittered.
Read guideA web shell is attacker code planted in your web root for remote command execution. Here's how they get in, and the high-fidelity ways to catch them.
Read guideAttackers with a stolen password spam push prompts until a tired user taps 'Approve'. Here's how MFA fatigue works and the controls that actually stop it.
Read guideExfiltration is the goal of most intrusions. Learn the channels attackers use to move data out and the signals that catch it before the breach is complete.
Read guideIn the cloud, the audit log is your endpoint. Learn what CloudTrail (and its peers) capture, the events that matter, and why attackers try to silence them.
Read guideSQL injection is decades old and still everywhere. Learn how it works, the flavors attackers use, and how to detect and prevent it for good.
Read guideServer-Side Request Forgery turns your server into the attacker's proxy - and in the cloud, it can steal credentials from the metadata endpoint. Here's the defense.
Read guideAfter the first foothold, attackers spread. Learn the common lateral-movement techniques (PsExec, WMI, RDP) and the Windows events that expose them.
Read guidePersistence is how malware survives a reboot. Learn the most common Windows persistence spots - Run keys, services, scheduled tasks, WMI - and how to find them.
Read guideThe three records that decide whether an attacker can spoof your domain. Learn what SPF, DKIM and DMARC each do - and how to deploy them without breaking mail.
Read guideWhen you can't breach the target, breach their software. Learn how build-pipeline and dependency attacks work - and how defenders detect and blunt them.
Read guideThe acronyms every SOC lives in. Learn what EDR, SIEM and XDR actually do, where each shines, and how they fit together in a modern detection stack.
Read guideThe fastest way to learn blue-team skills is to build a lab and attack it. Here's a simple, free home SOC lab and what to practice in it.
Read guidePassword spraying flips brute force on its head: one password against many accounts, low and slow to dodge lockouts. Here's how to catch it.
Read guideWith the KRBTGT hash, an attacker forges Kerberos tickets and owns the domain invisibly. Learn how Golden/Silver tickets work and how defenders respond.
Read guideNTLM relay lets an attacker authenticate as a victim without ever cracking a password. Learn the coercion-to-relay chain and how to shut it down.
Read guideYARA is the pattern-matching language of malware analysis and threat hunting. Learn to read and write a rule that identifies files by content.
Read guideSysmon turns Windows into a detection powerhouse - but only with a good config. Learn the events that matter and how to deploy it well.
Read guideAttackers put phishing URLs in QR codes to dodge email link scanners and move the victim to a phone. Here's how quishing works and how to defend.
Read guideCobalt Strike is the most abused C2 framework in real intrusions. Learn its tells - beacons, named pipes, JA3, spawn patterns - and how to catch it.
Read guideRed finds gaps; blue closes them; purple does both together. Learn how to run a purple-team exercise that measurably improves your detection coverage.
Read guideSOAR automates the repetitive parts of security operations so analysts focus on judgment. Learn what to automate, what not to, and how to build a safe playbook.
Read guideMost cloud breaches start with a misconfiguration, not an exploit. Learn what CSPM checks for and the handful of misconfigs that cause the most damage.
Read guideZero Trust replaces 'trusted internal network' with 'never trust, always verify'. Learn the core principles and how defenders actually implement it.
Read guideFlat networks let one foothold become total compromise. Learn how segmentation limits blast radius and turns lateral movement into a detectable event.
Read guideThe worst time to test your IR plan is during a real breach. A tabletop exercise finds the gaps in a conference room, cheaply. Here's how to run one.
Read guideDeception flips the attacker's advantage: decoys that no legitimate user should ever touch, so any interaction is a high-fidelity alert. Here's how to use them.
Read guideBugs are cheapest to fix before they ship. Learn what to look for in a security code review - the vulnerable patterns that cause the most real-world breaches.
Read guideA SIEM is only as good as its logs. Learn how to prioritize, onboard and validate log sources so your detections actually have data to fire on.
Read guide