## ShroudCloud Threat intelligence, detection engineering, and intrusion analysis from someone who runs a detection stack and builds rules out of what the telemetry actually shows. The write-ups keep the parts that usually get paraphrased away. An intrusion here comes with the command lines the operator typed, in the order they typed them, and the detection logic sits next to the behavior it's meant to catch instead of in an appendix. Threat profiles carry the observed commands alongside the ATT&CK mapping for the same reason. Most of it comes back to practical questions, like what Akira affiliates run once they've landed, which artifact Impacket's WmiExec leaves on every target, how a ClickFix loader pulls NetSupport out of a working PNG, and why an Rclone rule should key on PE metadata when the binary gets renamed on almost every intrusion. ### What's here - The [[Detection Engineering]] write-ups walk each intrusion stage by stage, with Sigma logic inline and gaps called out wherever the telemetry fell short. - [[Intrusion Analysis]] follows single intrusion chains from the first pasted command to the final payload, decoding each stage along the way. - [[Threat Profiles]] cover active RaaS operations, loaders, and affiliate toolkits, following each infection chain with a detection opportunity at every step. - Everything under [[Detections]] is open-source Sigma built from real intrusion data and written against the threats profiled here. - Philosophy is two short notes. [[Detection Principles]] argues that behaviors outlast indicators and that a rule costing more upkeep than it catches should be retired, and [[Intel Principles]] holds that intelligence exists to reduce a defender's uncertainty, and that a claim should be hedged in proportion to its distance from the evidence. ### Tools I also maintain [Field Kit](https://opus-oss.github.io/field-kit/), a set of single-page utilities that run entirely in the browser. Three of them earn their place here. [Grapevine](https://opus-oss.github.io/field-kit/intel.html) pulls about forty vendor research and advisory feeds several times a day and filters out the product-marketing posts. Its most useful view flags any actor, malware family or CVE that turns up in two or more sources at once. It reads a JSON file the repo rebuilds on a schedule, so there's no sign-up and it makes no third-party requests. [Chef](https://opus-oss.github.io/field-kit/chef.html) is the decoder for when a sample hands you a wall of base64. Paste a PowerShell `-enc` string, a hex dump, a JWT or a base64-then-gzip blob and it works out the recipe itself, showing each step as it peels the layers off. None of it leaves the page, which matters when the blob came off a live host. [ASCII Forge](https://opus-oss.github.io/field-kit/ascii.html) turns an image into text art on device, with the character set, contrast and edge weighting under your control. The compass on [[Intel Principles]] came out of it. The site itself runs a Publish build of [Opus](https://github.com/opus-oss/obsidian-opus), the Obsidian theme I maintain. It's listed in Obsidian's community themes if you want the same look in your own vault.