8 results
- ThreatHunting PHP2Shell: the behaviour outlasts the exploit
Hunting PHP2Shell using custom queries in Command Zero, chained into an investigation that ends in a verdict, and a platform-agnostic web server hunt for whatever exploit comes next.
October 2026 · 11 min readRead → - ThreatHunting the ConnectWise (SkyKick) App Abuse with Command Zero
Attackers used ConnectWise's own app credentials to sign in to Microsoft 365 tenants. Here's how to hunt for the sign-ins, the self-assigned roles, and the client secrets they left behind.
October 2026 · 9 min readRead → - NewsInvestigating Microsoft 365 Direct Send Abuse: When Convenience Becomes a Vulnerability
Real-World Impact: Get to Answers in Minutes, not Hours
October 2025 · 9 min readRead → - InvestigationsInvestigating Locked Accounts: Making sense of the canary in the coal mine
Streamlining locked account investigations with Command Zero
March 2025 · 5 min readRead → - ProductEmail Investigations: The Epicenter of Security Analysis
The hard truth: Emails are full user identities
February 2025 · 6 min readRead → - InvestigationsInvestigations lack consistency, documentation and auditabilityNovember 2024 · 8 min readRead →
- ResearchUniversal talent gap in cybersecurity hinders the ability to run investigationsOctober 2024 · 7 min readRead →
- ResearchTransforming cyber investigations: The power of asking the right questions
In the ever-evolving landscape of cybersecurity, the complexity and volume of threats continue to escalate.
July 2024 · 12 min readRead →
Get Started
See what your team can achieve.
Live in under an hour. No migration. No friction.
No training data requiredSOC 2 CompliantDirect-to-data