apps-ir.com

Writing

Curated posts and notes. Full archive lives on Medium.

Featured

Signature work: durable workflows you can reuse in real environments.

Run Cortex XSIAM XQL hunts via the Public API 2025

From UI queries to repeatable workflows

Turning telemetry into repeatable detection logic and automation.

More coming soon. This section will track automation, APIs, and detection engineering workflows.

How adversaries operate: artifacts, execution paths, and defender pivots.

Malicious LNK file analysis 2024

Artifact breakdown and investigation notes
Obfuscated VBScript analysis 2024

Deobfuscation workflow and behavioral takeaways
It’s Dark(gate)! 2024

Tradecraft notes and defender pivots
What’s PPAM? 2024

Execution context, abuse potential, and defender implications