Series

Cyber Defense

Defense isn't passive. It's a fight.

Abusing Content Delivery Networks (CDNs): Phishing, Malware, and Evasion
Content Delivery Networks (CDNs) like jsDelivr, Webflow CDN, CloudFront, and Google APIs are trusted internet infrastructure – and attackers are abusing that trust. By hosting malicious pages and payloads on CDN domains, adversaries exploit the domai...
May 24, 202515 min read999
Threat Analysis: Investigating Suspicious Outbound Connections to cdn.jsdelivrs[.]com (Adware or Supply Chain Foothold?)
Alert Overview On May 8, 2025, analysts at the FPT SOC identified a cluster of outbound HTTP requests from several internal endpoints targeting the domain cdn.jsdelivrs[.]com. This domain, which resolves to IP 91.195.240.12, is registered under AS478...
May 21, 20253 min read862
Reducing Alert Fatigue: Automating the Triage of Microsoft Defender’s Internal Port Scanning Alerts
Introduction Modern security operations rely on automated alerting to detect reconnaissance activities within enterprise networks. However, when certain alerts trigger frequently, distinguishing between benign system behavior and true security threat...
Feb 23, 20255 min read467
SigmaGen: AI-Powered ATT&CK-Mapped Threat Detection with Sigma Rules
Introduction As cyber threats evolve, the ability to detect and respond to adversarial activity effectively depends on well-structured and frequently updated detection rules. The MITRE ATT&CK® framework provides a standardized way to classify adversa...
Feb 12, 20256 min read2.1K