Retired-machine walkthroughs and the detections that catch them.https://erenatalay.com/https://erenatalay.com/blog/detecting-the-cicada-chain/https://erenatalay.com/blog/detecting-the-cicada-chain/The offensive companion showed how an easy AD box falls. This one flips it: every hop — the spray, the LDAP secret read, the backup-privilege hive dump, the pass-the-hash — mapped to concrete Windows telemetry and Wazuh/Sigma logic a SOC can actually ship.Thu, 04 Jun 2026 00:00:00 GMThttps://erenatalay.com/blog/cicada/https://erenatalay.com/blog/cicada/A retired, beginner-friendly Windows AD box: how a read-only share, a password reused in an LDAP field, and a backup privilege chain together into full domain compromise — and what each step should have set off in a SOC.Tue, 02 Jun 2026 00:00:00 GMT