Behavior over branding
Actor names change. The observable behaviors defenders must detect are the durable part.
PATTERNSStart a conversation
OPERATOR PROFILE / 01
BEHIND
THE SIGNAL.
TD / 001
01 — PROFILE
I'm Tobias Diehl, a security researcher interested in the space between knowing how an adversary operates and proving your controls can see it.
My work centers on recent threat actor activity, the behaviors behind the headlines, and how organizations can recreate those behaviors safely to evaluate their endpoint defenses.
Attack Patterns is where I publish that process: focused analysis, reproducible validation ideas, expected telemetry, and the questions a purple team should ask after the exercise is over.
OPERATING PRINCIPLES
Research should end
in a decision.
Evidence over confidence
A control is only as useful as the telemetry, alert, and response decision you can verify.
Safe by design
Every validation plan should be scoped, reversible, and appropriate for an authorized lab.
OPEN CHANNEL