Bruce Mikel

Security writeups & labs. Drag the map, hover a node, click to read.

Two Versions of a Crackme: Base64, MD5, and the Two Bytes That Never Changed

Hunting What the Alerts Missed: Threat Hunting Sysmon in Splunk

Portable OT Detections: Writing Sigma Rules for DNP3 and Modbus

Taking Apart a Backdoor DLL in IDA Pro (Practical Malware Analysis Lab 5-1)

Building an Isolated Malware Analysis Lab in VirtualBox

Reading PE Headers by Hand: 32-bit vs. 64-bit, Five Tools, One Hex Editor

A Denial-of-Service in whisper.cpp's Parakeet Model Loader

Fuzzing libming with AFL++: From 177 Crashes to a Root Cause

Beating Linux Exploit Mitigations One at a Time

Atomic Red Team vs. My Splunk Detections: What Actually Fired

Same Detection, Two Languages: Writing My Splunk Detections in KQL

Which Logs Are Worth the License? Measuring What Each Windows Source Costs in Splunk

Onboarding a Windows Client to Splunk: Deployment Server, Universal Forwarder, and the Gotchas Nobody Mentions

OSCP Prep: Owning the Secura Challenge Lab

From Pipeline Findings to a Risk Register

SOC 2 vs ISO 27001: What's Actually Different

SOC 2 as Code: Automating Evidence Collection for a SaaS Startup

CIP in a Virtual World: Categorizing the Lab under FERC Order 919

GRC-as-Code: Automating CIP-010 Baselines and Evidence

Watching the Inside: CIP-015 INSM with Zeek and Suricata