PenTestIT.com

Your source for Detection Engineering, Security Research and Adversary Simulation

Offensive Security

Analysing BigDiskBuster, the Microsoft Defender Update Blocker

This is my analysis of the BigDiskBuster - the open source Microsoft Defender Update Blocker.

Posted: by Leave a Comment

Last week Nightmare Eclipse open sourced BigDiskBuster - although I can see that now all the repositories have been made private. This post is my analysis of this tool that many news outlets called a "0day" initially. In reality, it is a class of defense-evasion tools that never touches a security product - Windows Defender in this case. It does not involve a driver unload, or Read more about Analysing BigDiskBuster, the Microsoft Defender Update Blocker

Cyber Threat Intelligence

Claude Skill: threat-report-killchain

This post documents the features and working of a Claude skill that helps you automatically triage evidence backed threat intel reports.

Posted: by Leave a Comment
Updated:

Everyday when I come across a threat intelligence report, I have to sift through a lot of data to get to the gist of it. Hence, I created this "threat-report-killchain" Claude skill to automate the process of CTI report triage for me. It does so completely, well 80% to be precise. Since, it helped me a lot, I thought of open sourcing it for the community. This post describes Read more about Claude Skill: threat-report-killchain

Cyber Threat Intelligence

Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority

This blog is my interpretation of the Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority

Posted: by
Updated:

Back after a hiatus the Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority blog. Last time I did this was Microsoft Patch Tuesday March 2026 Exploitability and Patching Priority. This time around, I am doing two things differently. I am ranking every priority against CISA BOD 26-04. Interested? Read on! Read more about Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority

Cyber Threat Intelligence

Claude Skill: cve-check

This post describes a Claude Skill named cve-check that I wrote to enrich CVE information for threat intelligence collection

Posted: by

If you follow me on LinkedIn, I released this skill there first. Resharing here if you don't. I created the cve-check Claude Skill to resolve multiple searches to begin my vulnerability mitigation research . The skill automates and presents multiple prerequisites that help you prioritize your threat detection backlog. Read on for more details. Read more about Claude Skill: cve-check

Detection Engineering

Essential Detection Engineering Metrics

This is a list of essential detection engineering metrics.

Posted: by
Updated:

You have prioritized your threat detection backlog, but now want to quantify the progress. Throughout my career leading multiple threat detection engineering teams, I have relied on well-defined metrics to measure outcomes, demonstrate program value, and drive continuous improvement. In this post, I outline the detection engineering metrics I consider most important, spanning Read more about Essential Detection Engineering Metrics