From Intern to Splunk Architect – Krisztián’s story
Why did you choose BlackCell? How did you decide you wanted to work here? My initial access with Black Cell happened in 2021, when I was looking for an internship. Black Cell was surprisingly open and welcoming about granting me temporary access, and the moment I...
Monthly Adversary Tradecraft Spotlight – August
Exports Critical Registry Keys To a File The Windows Registry stores a significant amount of operating system and security information. The SAM (Security Account Manager) hive contains local account password hashes, the SYSTEM hive contains the boot key required to...
Supercharge Your Intune Fleet with New Features Included in Microsoft 365 E3 and E5
Last December, Microsoft announced that Microsoft 365 E3 and E5 customers will receive additional AI, security, and endpoint management capabilities at no additional cost: These enhancements are expected to become available during 2026, and we have already seen them...
Monthly Adversary Tradecraft Spotlight – July
Potential MSTSC Shadowing Activity MSTSC shadowing is an attractive technique because it allows attackers to interact with an already authenticated user session without needing to steal credentials or create a new login event. Once an attacker has gained sufficient...
Think Like an Attacker: Spot the Security Risks
Wi-Fi password posted on the wall ("Office-WiFi / Password: Office123!") Unattended laptop left unlocked Mobile phone left unattended on the desk Password written on a sticky note ("New password Summer2024") Sensitive handwritten notes left in the open Printed...
Monthly Adversary Tradecraft Spotlight – June
OpenWith.exe Executes Specified Binary This technique leverages OpenWith.exe as a proxy execution mechanism to run arbitrary code while blending in with legitimate system activity. It is a trusted Windows binary that is typically used when a user selects “Open with…”...
The Extension Threat Vector: Protecting Browsers and Dev Environments?
If your organization doesn’t manage extensions and your users can freely install any browser and VSCode addons, you have an unmanaged code execution surface running with potentially elevated trust on your devices. The GitHub breach last month is just the latest proof...
Monthly Adversary Tradecraft Spotlight – May 2026
Windows Recovery Environment Disabled Via Reagentc WinRE exists specifically to help users repair boot problems, restore previous system states, and troubleshoot failures when Windows can no longer start normally. Disabling the Windows Recovery Environment (WinRE) is...
The Role of AI in Cybersecurity: Smarter Defense Against Evolving Threats
Artificial intelligence is transforming cybersecurity by helping organizations detect threats faster, reduce manual workload, and improve response capabilities. As cyberattacks become more sophisticated, AI enables security teams to move from reactive defense to...
