Recently something interesting happened.

My research on DLL hijacking detection was referenced in work from the National Cyber Security Centre (Cyber Defence Analysis).

The section “37 Sysmon Events. One Complete DLL Hijacking Attack” came from my analysis of malware telemetry showing how code execution occurred without triggering alerts.

To clarify: the detection PoC mentioned later isn’t mine — my contribution focused on identifying the detection gap.

Right now I’m continuing to explore:

• Sysmon event correlation • Detection blind spots in Windows telemetry • Why some attacks still bypass common logging assumptions

If you're working on detection engineering, threat hunting, or malware analysis, I’d be happy to exchange ideas. #threathunting #Malwareanalysis #Medium #Infosec #detectionengineering