Threat Intelligence
Pass-the-Hash Prevention: Stop Credential Theft Without NTLMv2
Disabling NTLM entirely breaks pass-the-hash chains, forcing attackers to capture live credentials instead of reusable hashes.
Threat Intelligence
Threat Intelligence coverage from TechSec Feed holds 12 articles, 12 of them reference guides. The newest was published on October 14, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include FIRST: Forum of Incident Response and Security Teams and MITRE ATT&CK.
Threat Intelligence
Threat Intelligence
STIX and TAXII: Standardizing Threat Intelligence Exchange
Structured data formats prevent intelligence decay and enable automated response actions that raw text reports cannot support.
Threat Intelligence
ASN Threat Intelligence: Small Business Network Defense
Autonomous system numbers reveal the origin of malicious traffic, allowing small networks to block entire hostile infrastructure blocks rather than single IP addresses.
Threat Intelligence
How the MITRE ATT&CK Navigator Maps Tactics to Detection
The Navigator does not analyze traffic; it structures human judgment into a visual grid that forces teams to confront specific gaps in their detection logic.
Threat Intelligence
How Small Businesses Use ISACs for Threat Intelligence
Industry-specific threat groups provide structured intelligence feeds that small teams can parse without hiring dedicated analysts or buying expensive platforms.
Threat Intelligence
Scheduled Task Abuse: How Attackers Hide Persistence and Execution
Attackers hijack legitimate Windows scheduling mechanisms to bypass application whitelisting and maintain access after reboots.
Threat Intelligence
Command and Control Traffic: Stages, Mechanics, and Interruption Points
Command and control channels often mimic standard web traffic, hiding malicious data within the headers and timing patterns of legitimate protocols rather than in obvious payloads.
Threat Intelligence
AS-REP Roasting Response: Containment, Recovery and Prevention Steps
Forcing password resets does not stop an attacker who already holds the offline hash, requiring a specific protocol change to invalidate the stolen data.
Threat Intelligence
Sysmon for Small Teams: Low-Cost Monitoring That Actually Works
Sysmon reveals process lineage and network connections that standard logs ignore, exposing lateral movement even when attackers delete their tracks from the filesystem.
Threat Intelligence
Canary Tokens Checklist for Detecting Early Intrusion Attempts
Canary tokens generate noise to mask true alerts, requiring a dedicated filtering strategy to prevent security teams from ignoring real threats.
Threat Intelligence
Snort and Suricata Rule Hygiene: 8 Practices for Fewer Alerts
Most intrusion detection noise stems from stale rules and vague signatures, not from complex evasion techniques used by attackers.
Threat Intelligence
Detect Nation-State Cyber Attacks: Signals, Tools and Blind Spots
Nation-state actors blend into background noise by mimicking administrative tasks, making standard alerting useless without behavioral context.