corpus.blog
41554 blogs · [ { "id": "01a08787-f2da-7214-9aaf-4c728b35ff82", "title": "An inside look at NSA (Equation Group) TTPs from China’s lense", "url": "https://www.inversecos.com/2025/02/an-inside-look-at-nsa-equation-group.html", "published_at": "2025-02-19T05:43:00+00:00" }, { "id": "01a08787-f2da-7214-9aaf-4c728b960ada", "title": "Understanding Tokens in Entra ID: A Comprehensive Guide", "url": "https://www.inversecos.com/2024/09/understanding-tokens-in-entra-id.html", "published_at": "2024-09-21T07:47:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e17995c666d7", "title": "Detecting Lateral Movement in Entra ID: Cross Tenant Synchronization", "url": "https://www.inversecos.com/2024/09/detecting-lateral-movement-in-entra-id.html", "published_at": "2024-09-21T07:43:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e17995f7194a", "title": "Azure Command Line Forensics - Host Based Artifacts", "url": "https://www.inversecos.com/2023/03/azure-command-line-forensics-host-based.html", "published_at": "2023-03-09T06:57:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e179965d51ab", "title": "Detecting Fake Events in Azure Sign-in Logs", "url": "https://www.inversecos.com/2023/01/detecting-fake-events-in-azure-sign-in.html", "published_at": "2023-01-11T06:37:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e17996a105e5", "title": "How to Detect Malicious OAuth Device Code Phishing", "url": "https://www.inversecos.com/2022/12/how-to-detect-malicious-oauth-device.html", "published_at": "2022-12-15T05:22:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e17997241c4a", "title": "Recovering Cleared Browser History - Chrome Forensics", "url": "https://www.inversecos.com/2022/10/recovering-cleared-browser-history.html", "published_at": "2022-10-26T06:36:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e17997bb323d", "title": "How to Investigate Insider Threats (Forensic Methodology)", "url": "https://www.inversecos.com/2022/10/how-to-investigate-insider-threats.html", "published_at": "2022-10-13T06:08:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e17998a544ca", "title": "Forensic Detection of Files Deleted via SDelete", "url": "https://www.inversecos.com/2022/09/forensic-detection-of-files-deleted-via.html", "published_at": "2022-09-06T06:45:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e17998dbb69b", "title": "How to Detect OAuth Access Token Theft in Azure", "url": "https://www.inversecos.com/2022/08/how-to-detect-oauth-access-token-theft.html", "published_at": "2022-08-23T07:49:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e17999cb3be3", "title": "Detecting Linux Anti-Forensics: Timestomping", "url": "https://www.inversecos.com/2022/08/detecting-linux-anti-forensics.html", "published_at": "2022-08-05T06:20:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e1799a49ee80", "title": "Hunting for APT Abuse of Exchange", "url": "https://www.inversecos.com/2022/07/hunting-for-apt-abuse-of-exchange.html", "published_at": "2022-07-21T06:26:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e1799b271c22", "title": "Heap Overflows on iOS ARM64: Heap Spraying, Use-After-Free (Part 3)", "url": "https://www.inversecos.com/2022/07/heap-overflows-on-ios-arm64-heap.html", "published_at": "2022-07-13T06:28:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e1799bcfe0c6", "title": "Detecting Linux Anti-Forensics Log Tampering", "url": "https://www.inversecos.com/2022/06/detecting-linux-anti-forensics-log.html", "published_at": "2022-06-22T07:22:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e1799c66915a", "title": "Guide to Reversing and Exploiting iOS binaries Part 2: ARM64 ROP Chains", "url": "https://www.inversecos.com/2022/06/guide-to-reversing-and-exploiting-ios.html", "published_at": "2022-06-16T07:30:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e1799d03f0af", "title": "How to Reverse Engineer and Patch an iOS Application for Beginners: Part I", "url": "https://www.inversecos.com/2022/06/how-to-reverse-engineer-and-patch-ios.html", "published_at": "2022-06-07T06:19:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e1799da11aed", "title": "How to Perform Clipboard Forensics: ActivitiesCache.db, Memory Forensics and Clipboard History", "url": "https://www.inversecos.com/2022/05/how-to-perform-clipboard-forensics.html", "published_at": "2022-05-27T06:55:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e1799e6477bc", "title": "Detection and Compromise: Azure Key Vaults & Secrets", "url": "https://www.inversecos.com/2022/05/detection-and-compromise-azure-key.html", "published_at": "2022-05-17T06:18:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e1799ef899bd", "title": "Defence Evasion Technique: Timestomping Detection – NTFS Forensics", "url": "https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html", "published_at": "2022-04-28T07:09:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e1799f5bb96d", "title": "Malicious Registry Timestamp Manipulation Technique: Detecting Registry Timestomping", "url": "https://www.inversecos.com/2022/04/malicious-registry-timestamp.html", "published_at": "2022-04-06T06:55:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e1799fbd0441", "title": "Windows Event Log Evasion via Native APIs", "url": "https://www.inversecos.com/2022/03/windows-event-log-evasion-via-native.html", "published_at": "2022-03-23T05:55:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e1799ff034aa", "title": "How to Detect and Compromise Azure Blobs and Storage Accounts", "url": "https://www.inversecos.com/2022/01/how-to-detect-and-compromise-azure.html", "published_at": "2022-01-25T05:37:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e179a0c38a11", "title": "How to Detect Malicious Azure Persistence Through Automation Account Abuse", "url": "https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html", "published_at": "2021-12-16T05:12:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e179a131d665", "title": "How to Detect Azure Active Directory Backdoors: Identity Federation", "url": "https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html", "published_at": "2021-11-24T05:51:00+00:00" }, { "id": "01a08787-f2db-71d9-933b-e179a156d381", "title": "How to Backdoor Azure Applications and Abuse Service Principals", "url": "https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html", "published_at": "2021-10-26T07:19:00+00:00" } ] posts Claim your blog
Back to inversecos.com
Blog · corpus.blog/blogs/inversecos.com/posts

inversecos.com

inversecos.com

2025

An inside look at NSA (Equation Group) TTPs from China’s lenseoriginal ↗
19 Feb 2025

2024

Understanding Tokens in Entra ID: A Comprehensive Guideoriginal ↗
21 Sept 2024
Detecting Lateral Movement in Entra ID: Cross Tenant Synchronizationoriginal ↗
21 Sept 2024

2023

Azure Command Line Forensics - Host Based Artifactsoriginal ↗
9 Mar 2023
Detecting Fake Events in Azure Sign-in Logsoriginal ↗
11 Jan 2023

2022

How to Detect Malicious OAuth Device Code Phishingoriginal ↗
15 Dec 2022
Recovering Cleared Browser History - Chrome Forensicsoriginal ↗
26 Oct 2022
How to Investigate Insider Threats (Forensic Methodology)original ↗
13 Oct 2022
Forensic Detection of Files Deleted via SDeleteoriginal ↗
6 Sept 2022
How to Detect OAuth Access Token Theft in Azureoriginal ↗
23 Aug 2022
Detecting Linux Anti-Forensics: Timestompingoriginal ↗
5 Aug 2022
Hunting for APT Abuse of Exchangeoriginal ↗
21 Jul 2022
Heap Overflows on iOS ARM64: Heap Spraying, Use-After-Free (Part 3)original ↗
13 Jul 2022
Detecting Linux Anti-Forensics Log Tamperingoriginal ↗
22 Jun 2022
Guide to Reversing and Exploiting iOS binaries Part 2: ARM64 ROP Chainsoriginal ↗
16 Jun 2022
How to Reverse Engineer and Patch an iOS Application for Beginners: Part Ioriginal ↗
7 Jun 2022
How to Perform Clipboard Forensics: ActivitiesCache.db, Memory Forensics and Clipboard Historyoriginal ↗
27 May 2022
Detection and Compromise: Azure Key Vaults & Secretsoriginal ↗
17 May 2022
Defence Evasion Technique: Timestomping Detection – NTFS Forensicsoriginal ↗
28 Apr 2022
Malicious Registry Timestamp Manipulation Technique: Detecting Registry Timestompingoriginal ↗
6 Apr 2022
Windows Event Log Evasion via Native APIsoriginal ↗
23 Mar 2022
How to Detect and Compromise Azure Blobs and Storage Accountsoriginal ↗
25 Jan 2022

2021

How to Detect Malicious Azure Persistence Through Automation Account Abuseoriginal ↗
16 Dec 2021
How to Detect Azure Active Directory Backdoors: Identity Federationoriginal ↗
24 Nov 2021
How to Backdoor Azure Applications and Abuse Service Principalsoriginal ↗
26 Oct 2021