Ghost Spy SecurityCybersecurity research, tooling and technical writeups from an offensive security engineer.https://ghostspysecurity.com/enA Defender KQL query for rare parent–child process pairshttps://ghostspysecurity.com/notes/defender-kql-rare-parent-child/https://ghostspysecurity.com/notes/defender-kql-rare-parent-child/Surface unusual process ancestry (e.g. Office spawning a shell) by scoring parent–child pairs against their historical frequency.Sat, 11 Jul 2026 00:00:00 GMTField NoteDetectionkqldefenderdetectionOne-liner: pull an Azure IMDS token from a compromised VMhttps://ghostspysecurity.com/notes/imds-one-liner/https://ghostspysecurity.com/notes/imds-one-liner/A quick reminder of the Instance Metadata Service call that turns VM access into an Azure AD token — and why egress filtering matters.Thu, 09 Jul 2026 00:00:00 GMTField NoteAzureazureimdsreconContinuously Monitor a Bug Bounty/Organisations Attack Surface With One Simple Scripthttps://ghostspysecurity.com/blog/mapping-external-attack-surface/https://ghostspysecurity.com/blog/mapping-external-attack-surface/A repeatable, tool-driven workflow for discovering, probing and prioritising internet-facing assets — from subdomain enumeration to templated scanning.Wed, 08 Jul 2026 00:00:00 GMTBlogReconreconeasmasmtoolingDetecting Lateral Movement Without Drowning in Noisehttps://ghostspysecurity.com/blog/detecting-lateral-movement/https://ghostspysecurity.com/blog/detecting-lateral-movement/Practical detection engineering for east-west movement — the signals that matter, the ones that don't, and how to tune for a signal-to-noise ratio you can actually live with.Sun, 05 Jul 2026 00:00:00 GMTBlogDetection Engineeringdetectionblue-teamthreat-hunting