Defence blues

Patterns and detection

Red wilds
Privacy greenhouse
Purple crossroads
Indigo observatory
Contact

Initializing search

Defence blues

Mostly harmless, occasionally heroic:
Mostly harmless, occasionally heroic:
Going places:
Going places:
Middle ground:
Middle ground:
End of story:
End of story:
- Watching for data being gathered
  Watching for data being gathered
  - Patterns and detection
    
    Patterns and detection
    
    Collection: defender context
    
    Detecting collection activity
  - Patterns and detection Patterns and detection
    Table of contents
    
    Collection: defender context
    
    Detecting collection activity
  - Collection activity hunting
- Watching the exits
- Limiting the blast radius
Active defence:
Active defence:
- Honeytech for humans

Patterns and detection¶

Context and detection patterns for the collection phase, covering how attackers identify, aggregate, and stage data before exfiltration.

Collection: defender context
Detecting collection activity

2026-03-24 00:34

© Copyright 2025, TyMyrddin.

Created using Sphinx 7.2.6. and Sphinx-Immaterial

Made with love in the Unseen University, 2025, with a forest garden fostered by /ut7