Christopher Peacock

My SANS Purple Team Series: Threat-Informed Detection Engineering Webinar with @jorgeorchilles is on YouTube! Video: youtu.be/2czm8dhziX8 Blog post: sans.org/blog/purple-te…

@anton_chuvakin You’re leaving Google or there’s no way to actually fix the GUI in Chronicle?

I may have some news soon :-/

Jane Street Blog - Magic-trace: Diagnosing tricky performance issues easily with Intel Processor Trace blog.janestreet.com/magic-trace/

"Malware Detection Using Electromagnetic Side-Channel Analysis" by Matthew A. Bergstedt scholar.afit.edu/etd/5316/

SLAM Lab: Side-Channel Security slam.ece.utexas.edu/projects/Secur…

Monitoring Side-Channel Signals Could Detect Malicious Software on IoT Devices coe.gatech.edu/news/2016/08/m…

What do you call a technique that’s documented in the popular CTI framework?

👀 github.com/SnailSploit/Cl…

Pretty interesting: retrieves the command-and-control (C2) domain from a blockchain smart contract. Instead of hardcoding the server address... queries multiple Polygon RPC endpoints defined in CONTRACT_CONFIG.RPC_HOSTS levelblue.com/blogs/spiderla…

This is very interesting for those working in DFIR: youtu.be/OsUg3TlAqjQ?si…

GenAI hype - when will we hit peak ignorance?

Dropping a new tool today: TTPRunner - One-click Vectr deploy - Give it a threat report, PDF, or just plain-english instructions and it'll build an execution & simulation plan for you - Executions are tracked via notes and automatically sync'd with Vectr Works great with: github.com/Antonlovesdnb/… Check it out! 🔽 github.com/Antonlovesdnb/…

Can LNK files ever be trusted? ⚡ My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target shown in Explorer. It also introduces tools to create your own LNKs, and detected spoofed ones yourself. 🐬 wietzebeukema.nl/blog/trust-me-…

I’m gonna need a copy of coalfire’s contract template since it’s battle tested and held up in court 😆 arstechnica.com/security/2026/…

AI can help build C2s and payloads, but often this seems to be the case.

“Benchmarked frontier AI models on realistic SecOps tasks using Cotool’s agent harness and the Splunk BOTSv3 dataset. GPT-5 achieved the highest accuracy (63%), while Claude Haiku-4.5 completed tasks the fastest with strong accuracy.“ cotool.ai/blog/evaluatin…

👀

🎄 It’s time! The 2025 SANS Holiday Hack Challenge is officially OPEN! Something’s off in the neighborhood… disappearing items, strange sightings, a chill in the air. ❄️ Can you uncover what’s really going on? Play now 👉 sans.org/u/1D01 #HolidayHackChallenge

Interesting worm: wiz.io/blog/shai-hulu…

binarydefense.com/resources/blog… (s/o tool author: @TwoSevenOneT)

IP2LoRa + Meshtastic 👀