Starting heversec
What this site is for, what will show up here, and how it is put together.
I’ve been doing cloud threat hunting long enough to accumulate a backlog of things worth writing down: detections that took three rewrites to stop paging people at 3am, tooling I built because nothing existing did the job, and techniques I’ve had to understand offensively before I could catch them.
This is where that goes.
What to expect#
- Detection engineering — rules, the reasoning behind them, and honest notes on what they miss. A detection published without its false-positive profile isn’t finished.
- Offensive technique breakdowns — how something actually works, paired with the telemetry that catches it. Always both halves.
- Tooling — utilities I’ve written for hunting and triage, with the design decisions exposed.
- Research notes — smaller findings that don’t warrant a full write-up but shouldn’t be lost.
How this site is built#
Static, deliberately. Astro renders Markdown at build time, the output deploys to Cloudflare’s edge, and the page you’re reading ships no JavaScript beyond a theme toggle. There’s no CMS, no database, and no server to patch — which for a security blog feels like the right amount of attack surface.
Every post lives as a Markdown file in Git, so I have the full history of what I wrote and when.
A standing caveat#
Everything here reflects what I understood at the time of writing. Cloud providers change telemetry, rename fields, and deprecate log sources without much ceremony. If a detection here stops working, the field it depended on probably moved — and I’d genuinely like to know about it.