From Passion to Purpose: Gergő’s Black Cell Story
Why did you choose Black Cell? How did you decide you wanted to work here? I have been interested in IT and information security since I was a child, although life took me in a different direction for a while. That interest never disappeared, so later I began further...
Monthly Adversary Tradecraft Spotlight – October
Suspicious Kerberos Ticket Request via PowerShell Script This technique is valuable because the Windows Credential Manager and Windows Password Vault often contain credentials that users have chosen to save for convenience. These stores may hold usernames, passwords,...
Generative AI Control using Sophos Firewall, Endpoint and AI Defense
Generative AI is already part of everyday work. Employees use it to analyse information, draft content, write code and reduce the time spent on repetitive tasks. In many organisations, however, adoption has moved faster than internal policies and security controls. ...
Q-Day: Ready for the Post-Quantum Age?
Why has post-quantum cryptography evolved from a technical issue into a governance and compliance challenge? In recent years, many organisations have regarded the cybersecurity risks associated with quantum computing as a distant concern, largely confined to research....
Monthly Adversary Tradecraft Spotlight – September
Suspicious Execution of Shutdown System shutdown and reboot operations can be useful for achieving several objectives during an intrusion. An attacker may intentionally reboot a compromised machine after modifying services, drivers, registry keys, scheduled tasks or...
From Intern to Splunk Architect – Krisztián’s story
Why did you choose BlackCell? How did you decide you wanted to work here? My initial access with Black Cell happened in 2021, when I was looking for an internship. Black Cell was surprisingly open and welcoming about granting me temporary access, and the moment I...
Monthly Adversary Tradecraft Spotlight – August
Exports Critical Registry Keys To a File The Windows Registry stores a significant amount of operating system and security information. The SAM (Security Account Manager) hive contains local account password hashes, the SYSTEM hive contains the boot key required to...
Supercharge Your Intune Fleet with New Features Included in Microsoft 365 E3 and E5
Last December, Microsoft announced that Microsoft 365 E3 and E5 customers will receive additional AI, security, and endpoint management capabilities at no additional cost: These enhancements are expected to become available during 2026, and we have already seen them...
Monthly Adversary Tradecraft Spotlight – July
Potential MSTSC Shadowing Activity MSTSC shadowing is an attractive technique because it allows attackers to interact with an already authenticated user session without needing to steal credentials or create a new login event. Once an attacker has gained sufficient...
