The Grimoire.
Papers and instructionals from the den. Monitoring, detection, opsec, tradecraft. Everything we learn, written down so you can do it yourself. Videos come later. No wall, no sign-up, ever.
Five open so far.
Opsec and tradecraft are on the bench. They land here when they're done.
Papers04
No. 01Paper
Athanor
The software factory. Agents build, other agents attack the work, and a person makes the calls that matter.
No. 02Paper14 min read
Running Wazuh fully offline
Every phone-home in Wazuh 4.14.8, how we caught each one on a sealed network, and the line that shuts it.
No. 03Paper17 min read
Tenant isolation in a shared log pipeline
Tag by peer address, not by what the sender claims. Then seal the tag, fail closed, and test it like an attacker.
No. 04Paper9 min read
Health you can trust
Nothing shows green unless a live check just passed. Three states, hard timeouts, no stored flags.
Coming and later
PapersComing
Opsec and tradecraft
Written down the way we actually do it. They land here when they're done.
VideosLater
Watch it done
Once the papers are solid. Same rule: no wall, no sign-up.
Instructional
Seven things before anything clever.
Seven controls that keep a box safe, whatever else runs on it. Do them first, on every machine, before anything clever. None of them costs a thing.
If gating something would make anyone easier to breach, it doesn’t get gated. That’s the whole rule.
HardeningDo these first
- 01MFA enforcement
- 02TLS 1.2+ only
- 03Secrets handling
- 04Audit logging
- 05Least privilege
- 06Egress default-deny
- 07Tested backup
Never gated · 7 controls