corpus.blog
56,966 blogs · [ { "id": "01a087be-8719-7396-a325-4f824ab08b55", "title": "AEMonitor: Monitoring Apple Events for Malware Analysis and Detection", "url": "https://pberba.github.io/security/2026/02/21/aemonitor/", "published_at": "2026-02-21T00:00:00+00:00" }, { "id": "01a087be-8719-7396-a325-4f824b0b9f36", "title": "Decompiling run-only AppleScripts", "url": "https://pberba.github.io/security/2025/12/14/decompiling-run-only-applescripts/", "published_at": "2025-12-14T00:00:00+00:00" }, { "id": "01a087be-8719-7396-a325-4f824c038970", "title": "Script Confusion: Playing with AppleScripts hidden in Named Forks", "url": "https://pberba.github.io/security/2025/11/15/playing-with-hidden-applescripts/", "published_at": "2025-11-15T00:00:00+00:00" }, { "id": "01a087be-8719-7396-a325-4f824c98e2f9", "title": "MacOS Infection Vector: Using AppleScripts to bypass Gatekeeper", "url": "https://pberba.github.io/security/2025/11/11/macos-infection-vector-applescript-bypass-gatekeeper/", "published_at": "2025-11-11T00:00:00+00:00" }, { "id": "01a087be-871a-716d-9022-ed2c704da8ae", "title": "Acquiring Malicious Browser Extension Samples on a Shoestring Budget", "url": "https://pberba.github.io/crypto/2024/09/14/malicious-browser-extension-genesis-market/", "published_at": "2024-09-14T00:00:00+00:00" }, { "id": "01a087be-871a-716d-9022-ed2c70cec3f7", "title": "Hunting for Persistence in Linux (Part 5): Systemd Generators", "url": "https://pberba.github.io/security/2022/02/07/linux-threat-hunting-for-persistence-systemd-generators/", "published_at": "2022-02-07T00:00:00+00:00" }, { "id": "01a087be-871a-716d-9022-ed2c719c168d", "title": "Hunting for Persistence in Linux (Part 4): Initialization Scripts and Shell Configuration", "url": "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/", "published_at": "2022-02-06T00:00:00+00:00" }, { "id": "01a087be-871a-716d-9022-ed2c721cf800", "title": "Hunting for Persistence in Linux (Part 3): Systemd, Timers, and Cron", "url": "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/", "published_at": "2022-01-30T00:00:00+00:00" }, { "id": "01a087be-871a-716d-9022-ed2c7247bb81", "title": "Hunting for Persistence in Linux (Part 2): Account Creation and Manipulation", "url": "https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/", "published_at": "2021-11-23T00:00:00+00:00" }, { "id": "01a087be-871a-716d-9022-ed2c72aac1f9", "title": "Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)", "url": "https://pberba.github.io/security/2021/11/22/linux-threat-hunting-for-persistence-sysmon-auditd-webshell/", "published_at": "2021-11-22T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-897715d73404", "title": null, "url": "https://pberba.github.io/crypto/2021/11/08/synack-redteam-invitational-ctf/", "published_at": "2021-11-08T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-897715236048", "title": null, "url": "https://pberba.github.io/security/2021/08/10/defcon-29-redteamvillage-ctf/", "published_at": "2021-08-10T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-8977151d7ef1", "title": null, "url": "https://pberba.github.io/security/2021/06/05/cve-2020-11978/", "published_at": "2021-06-05T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-897714b76d69", "title": null, "url": "https://pberba.github.io/security/2020/08/11/defcon-28-blueteam-opensoc-ctf/", "published_at": "2020-08-11T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-8977144c109a", "title": null, "url": "https://pberba.github.io/stats/2020/07/08/intro-hdbscan/", "published_at": "2020-07-08T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-897713d6c203", "title": null, "url": "https://pberba.github.io/security/2020/06/12/duo-u2f-phising/", "published_at": "2020-06-12T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-897713569772", "title": null, "url": "https://pberba.github.io/security/2020/05/28/lastpass-phishing/", "published_at": "2020-05-28T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-897713333dc3", "title": null, "url": "https://pberba.github.io/security/2020/04/26/lateral-movement/", "published_at": "2020-04-26T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-89771274334b", "title": null, "url": "https://pberba.github.io/stats/2020/01/17/hdbscan/", "published_at": "2020-01-17T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-897712040681", "title": null, "url": "https://pberba.github.io/stats/2019/11/04/time-complexity-for-data-scientists/", "published_at": "2019-11-04T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-8977118def02", "title": null, "url": "https://pberba.github.io/security/2019/10/08/data-exfiltration/", "published_at": "2019-10-08T00:00:00+00:00" }, { "id": "01a0e28a-2347-7301-a607-89771af70ac8", "title": null, "url": "https://pberba.github.io/404/", "published_at": null }, { "id": "01a0e28a-2347-7301-a607-89771b826b75", "title": null, "url": "https://pberba.github.io/crypto/", "published_at": null }, { "id": "01a0e28a-2347-7301-a607-89771ba7194d", "title": null, "url": "https://pberba.github.io/security/", "published_at": null }, { "id": "01a0e28a-2347-7301-a607-89771c26ef1f", "title": null, "url": "https://pberba.github.io/stats/", "published_at": null }, { "id": "01a0e28a-2347-7301-a607-89771d11971e", "title": null, "url": "https://pberba.github.io/about", "published_at": null }, { "id": "01a0e28a-2347-7301-a607-89771d8a593a", "title": null, "url": "https://pberba.github.io/", "published_at": null }, { "id": "01a0e28a-2347-7301-a607-89771dedc768", "title": null, "url": "https://pberba.github.io/posts/", "published_at": null } ] posts Claim your blog
Back to pberba.github.io
Blog · corpus.blog/blogs/pberba.github.io/posts

pberba.github.io

pberba.github.io

2026

AEMonitor: Monitoring Apple Events for Malware Analysis and Detectionoriginal ↗
21 Feb 2026

2025

Decompiling run-only AppleScriptsoriginal ↗
14 Dec 2025
Script Confusion: Playing with AppleScripts hidden in Named Forksoriginal ↗
15 Nov 2025
MacOS Infection Vector: Using AppleScripts to bypass Gatekeeperoriginal ↗
11 Nov 2025

2024

Acquiring Malicious Browser Extension Samples on a Shoestring Budgetoriginal ↗
14 Sept 2024

2022

Hunting for Persistence in Linux (Part 5): Systemd Generatorsoriginal ↗
7 Feb 2022
Hunting for Persistence in Linux (Part 4): Initialization Scripts and Shell Configurationoriginal ↗
6 Feb 2022
Hunting for Persistence in Linux (Part 3): Systemd, Timers, and Cronoriginal ↗
30 Jan 2022

2021

Hunting for Persistence in Linux (Part 2): Account Creation and Manipulationoriginal ↗
23 Nov 2021
Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)original ↗
22 Nov 2021
https://pberba.github.io/crypto/2021/11/08/synack-redteam-invitational-ctf/original ↗
8 Nov 2021
https://pberba.github.io/security/2021/08/10/defcon-29-redteamvillage-ctf/original ↗
10 Aug 2021
https://pberba.github.io/security/2021/06/05/cve-2020-11978/original ↗
5 Jun 2021

2020

https://pberba.github.io/security/2020/08/11/defcon-28-blueteam-opensoc-ctf/original ↗
11 Aug 2020
https://pberba.github.io/stats/2020/07/08/intro-hdbscan/original ↗
8 Jul 2020
https://pberba.github.io/security/2020/06/12/duo-u2f-phising/original ↗
12 Jun 2020
https://pberba.github.io/security/2020/05/28/lastpass-phishing/original ↗
28 May 2020
https://pberba.github.io/security/2020/04/26/lateral-movement/original ↗
26 Apr 2020
https://pberba.github.io/stats/2020/01/17/hdbscan/original ↗
17 Jan 2020

2019

https://pberba.github.io/stats/2019/11/04/time-complexity-for-data-scientists/original ↗
4 Nov 2019
https://pberba.github.io/security/2019/10/08/data-exfiltration/original ↗
8 Oct 2019

Undated

https://pberba.github.io/404/original ↗
—
https://pberba.github.io/crypto/original ↗
—
https://pberba.github.io/security/original ↗
—
https://pberba.github.io/stats/original ↗
—
https://pberba.github.io/aboutoriginal ↗
—
https://pberba.github.io/original ↗
—
https://pberba.github.io/posts/original ↗
—