Matt Swann

I’m Matt Swann, a cyber intelligence analyst and detection engineer working across the Microsoft security stack. Most of my work sits at the seam between threat intelligence and detection engineering — turning “here’s what the attacker did” into “here’s the query that catches it next time.” This site is where I collect the notes, tools, and write-ups that come out of that habit: I build something to solve my own problem, then write up what I learned.

Browse the series below, try the interactive tools I’ve built, or start with the latest post.

Unpacking QuimaRAT: From VBScript Dropper to a 255-Packet Offensive Framework

QuimaRAT is a new RAT being touted as a powerful cross-platform RAT capable of infecting Windows, MacOS, and Linux devices. While this is certainly true, it also happens to be quite an understatement. In this article we will unpack a VBScript dropper and analyze the subsequent JAR payload.

Step Aside Device Code Phishing, It's Passkey Vishing's Time to Shine

While modern phishing techniques like device code authorization phishing are still prevalent, a new vishing technique leveraging Entra ID passkeys is now stepping into the spotlight. Take a look as we dive into how passkey vishing works, and explain how a new Com-adjacent actor tracked by Okta as O-UNC-066, leverages these in their vishing campaigns.

When Comments Aren't Comments: Decoding An Obfuscated JavaScript Sample

An obfuscated JavaScript sample was observed on a device with an oddly large comment block at the top of the code. Students of programming are often taught that comments are not part of code itself and serve no other purpose other than to provide explanations for code blocks. In this article, we explore why that isn’t always true.

Detecting Suspicious RMM Tool Execution Chains in Microsoft Defender (T1219)

One of the most common initial access vectors into environments by threat actors is through use of legitimate RMM tooling, offering both hands-on-keyboard access as well as stealth. Read more below for some considerations on detecting such activity.

Detection Deep Dive: Encoded PowerShell Commands (T1059.001)

The first entry in the Detection Deep Dive series: mapping encoded PowerShell execution to detection logic in Microsoft Defender, tuning out the false positives, and knowing what the detection can’t see.

How a Single KQL Query Stopped an Entire EvilTokens Phishing Campaign

An AI-powered PhaaS campaign leaned on legit-vendor redirects and device-code phishing — but spoofing left a fingerprint. One KQL query plus a 5-minute MDE automation loop neutralized over 1,200 malicious emails in 48 hours.

AppDomainManager Injection — Bend .NET Assemblies to Your Will

A deep dive into AppDomainManager injection (T1574.014): how attackers use .NET’s own extensibility model to proxy execution of malicious assemblies through legitimate signed binaries, and what defenders can — and can’t — do about it.

5 KQL Queries to Slash Your Containment Time in Microsoft Sentinel

In an active breach, speed is everything. These five KQL queries — covering file drops, identity compromise, lateral movement, C2 beaconing, and persistence — are designed for the first hour of incident response.

Advent of Cyber 2025 Day 21 — Malware Analysis Bonus Challenge

A walkthrough of the TryHackMe Advent of Cyber 2025 Day 21 bonus challenge: peeling back a multi-layer HTA payload through VBScript analysis, Base64 decoding, and XOR decryption to uncover a hidden PNG.