sysop@hub:~/explainers/war-stories$
war-stories
Composite incident scenarios built from common, publicly documented attack patterns: how they unfolded, what the investigation found, and what would have helped. Not real organizations or real incidents.
AiTM phishing / business email compromise4 min readThe help desk that answered too fast
A finance employee approved an MFA prompt for a sign-in that wasn't theirs. Forty minutes later, an invoice went out with different bank details.
Kerberoasting / Active Directory3 min readThe service account nobody remembered
A five-year-old service account with a never-expiring password became the quiet path from a regular user account to Domain Admin.
Ransomware / disaster recovery4 min readThe backup that had never been tested
Backups were running every night for three years. Nobody had actually tried to restore from one until the night it mattered.