%% Generated by tools/shroudcloud_archive.py from article frontmatter. Edits here are overwritten on the next run. %% Detection write-ups, newest first. Each one works from real intrusion data to the detection logic that catches it, with the rules inline next to the behavior they target. > [!sc-card] [[Operator Playbook Part 1 - The Lateral Movement Chokepoint]] > ![[image_bank/cards/lateral_movement_methods_card.png]] > > `2026-04-17` `· updated 2026-09-08` > > Cross-RaaS analysis of lateral movement on Windows, organized by OS primitive rather than tool. Six primitives (WMI, Task Scheduler, SCM, WinRM, RDP, SMB) cover nearly all observed ransomware lateral movement. Native clients first, tool wrappers second, detection opportunities for each. > [!sc-card] [[Two PlayCrypt Intrusions Compared]] > > `2026-04-15` > > A comparative analysis of two distinct Play ransomware intrusions. Same closed operation, different environments, same playbook signature. Detection opportunities inline. > [!sc-card] [[Three Akira Intrusions Compared]] > > `2026-04-14` > > A comparative analysis of three distinct Akira ransomware intrusions. Same RaaS, different affiliates, different playbooks. Detection opportunities inline. > [!sc-card] [[Targeting ClickFix]] > ![[image_bank/cards/fakecaptcha_canvas_card.png]] > > `2025-06-01` `· updated 2025-06-11` > > Detection strategies for ClickFix (FakeCaptcha), built from the command lines seen in the wild and the obfuscation used to dodge them. > [!sc-card] [[Crafting Detections on Threat Actor Movement]] > ![[image_bank/cards/lateral_canvas_card.png]] > > `2025-02-27` > > Reviewing a late-stage FakeUpdates infection for detection opportunities (Part 2) > [!sc-card] [[Crafting Detections on IAB Behavior]] > ![[image_bank/cards/fakeupdates_site_to_detonation_card.png]] > > `2025-01-19` > > Reviewing a late-stage FakeUpdates infection for detection opportunities