Writeups
RSSRetired-machine walkthroughs and the detections that catch them.
Detecting the Cicada chain — turning an AD walkthrough into detections
The offensive companion showed how an easy AD box falls. This one flips it: every hop — the spray, the LDAP secret read, the backup-privilege hive dump, the pass-the-hash — mapped to concrete Windows telemetry and Wazuh/Sigma logic a SOC can actually ship.
Cicada — walking an easy Active Directory chain end to end
A retired, beginner-friendly Windows AD box: how a read-only share, a password reused in an LDAP field, and a backup privilege chain together into full domain compromise — and what each step should have set off in a SOC.