Thirdshift

Power-up macOS Zsh

When Apple switched to Zsh in macOS 10.15 Catalina, I relied on Armin Briegel's "Moving to Zsh" to guide me through the transition. This resource can be helpful for others making the switch. As I adapted to Zsh, I noticed many users prefer Oh My Zsh for its useful features. However, I find it overkill for my needs, so I maintain my own config file for control and simplicity. I still reference Oh My Zsh plugins on GitHub for inspiration. Below is my configuration file, with section explanations. PATH Adds your personal binaries (~/.local/bin) and common package manager locations (/usr/local/bin,...

Apr 1st, 2026 Tech

The Domain Lifecycle Problem in Threat Hunting

New domains in cybersecurity are often viewed with suspicion because they lack history and frequently appear in early detections. However, many new domains are benign, and malicious domains often do not remain active long enough for thorough analysis. This creates a core challenge for analysts: domains are dynamic, not static indicators. Recognizing their evolution and its impact on detection and response is essential for effective threat hunting. The Problem with “Point-in-Time” ThinkingTraditional security workflows often ask, “Is this domain malicious right now?” This approach is limited in scope. Threat actors exploit the delay between domain registration, detection, and enforcement. A...

Mar 20th, 2026 Threat Hunting

Threat Hunting vs. Network Forensics

Threat hunting and network forensics both identify and analyze malicious activity, but differ in approach, scope, and objectives. Each discipline is essential to a security strategy and often complements the other. Threat hunting is a proactive process that searches for threats before alerts are triggered, striving to detect advanced persistent threats, insider threats, and unknown attacks. It uses data from SIEM, EDR, and network traffic, and relies on hypothesis-driven analysis, behavior-based detection, and threat intelligence. Network forensics is a reactive approach that investigates incidents after they occur. Its goal is to collect, analyze, and reconstruct network events to determine the...

Feb 18th, 2026 Threat Hunting

The Month of Browser Bugs (MoBB)

The Month of Browser Bugs (MoBB), launched in July 2006 by security researcher H.D. Moore, uncovered numerous Remote Code Execution (RCE) vulnerabilities, generated multiple CVEs, and had a lasting impact on vulnerability disclosure practices. This project sparked a significant shift in fuzzing and full disclosure practices, as demonstrated by the following developments: MoBB demonstrated that fuzzing is highly effective at identifying vulnerabilities overlooked by traditional code analyzers. Today, fuzzing is an essential component of security testing and routinely uncovers critical bugs. The initiative intensified debates on ethical vulnerability disclosure and challenged the norms of "responsible disclosure" by combining private reporting...

Feb 13th, 2026 Reliving the Past

Why Correlation Matters

In SIEM/XDR, correlation ties related events across multiple data sources to identify meaningful activity patterns. Rather than analyzing logs or alerts in isolation, correlation examines concurrent events involving the same attributes available. Many security events, such as a login from a new location, a password reset, or a large file download, may seem benign on their own. When correlated, however, these events can reveal account compromise or malicious activity. Correlation helps security teams identify behavioral patterns that match known attack techniques, rather than focusing on isolated anomalies. What Correlation Actually DoesA shift in detection from an event-focused to a behavior-focused...

Feb 8th, 2026 SecOps

Data Quality for SecOps

Data quality is frequently neglected when it is treated as a singular remediation effort rather than a continuous process. It typically remains undetected until failures occur. In cybersecurity operations, such failures may manifest as missed alerts, failing machine learning models, undetected lateral movement, or inconclusive investigations due to incoherent log data. In practice, several core characteristics determine whether data is suitable for use in security monitoring. TruthfulnessData must be accurate, consistent, and reflective of actual conditions rather than assumptions or expectations. This distinction separates meaningful signals from irrelevant noise. If endpoint agents report incorrect host names or firewalls log inaccurate...

Feb 2nd, 2026 SecOps