## ShroudCloud Threat intelligence, detection engineering, and intrusion analysis from someone who runs a detection stack and builds rules out of what the telemetry actually shows. The write-ups keep the parts that usually get paraphrased away. An intrusion here comes with the command lines the operator typed, in the order they typed them, and the detection logic sits next to the behavior it's meant to catch instead of in an appendix. Threat profiles carry the observed commands alongside the ATT&CK mapping for the same reason. Most of it comes back to practical questions, like what Akira affiliates run once they've landed, which artifact Impacket's WmiExec leaves on every target, how a ClickFix loader pulls NetSupport out of a working PNG, and why an Rclone rule should key on PE metadata when the binary gets renamed on almost every intrusion. ### What's here - The Detection Engineering write-ups walk each intrusion stage by stage, with Sigma logic inline and gaps called out wherever the telemetry fell short. - Threat Profiles cover active RaaS operations, loaders, and affiliate toolkits, following each infection chain with a detection opportunity at every step. - Everything under Detections is open-source Sigma built from real intrusion data and written against the threats profiled here. - Philosophy is short and mostly argues two things, that behaviors outlast indicators and that a rule costing more upkeep than it catches should be retired. ### Tools I also maintain [Field Kit](https://opus-oss.github.io/field-kit/), a set of single-page utilities. The one that belongs on this site is [Intel Wire](https://opus-oss.github.io/field-kit/intel.html), which pulls about forty vendor research and advisory feeds several times a day and filters out the product-marketing posts. Its most useful view flags any actor, malware family, or CVE that turns up in two or more sources at once. It's a static page reading a JSON file the repo rebuilds on a schedule, so there's no sign-up and it makes no third-party requests. The site itself runs a Publish build of [Opus](https://github.com/opus-oss/obsidian-opus), the Obsidian theme I maintain. It's listed in Obsidian's community themes if you want the same look in your own vault.