<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0">
    <channel>
      <title>Enes Arda Baydaş</title>
      <link>https://enesardabaydas.dev</link>
      <description>Last 10 notes on Enes Arda Baydaş</description>
      <generator>Quartz -- quartz.jzhao.xyz</generator>
      <item>
    <title>Sentinel Native AI-Augmented Triage Agent</title>
    <link>https://enesardabaydas.dev/Engineering-Projects/Sentinel-Native-AI-Augmented-Triage-Agent</link>
    <guid>https://enesardabaydas.dev/Engineering-Projects/Sentinel-Native-AI-Augmented-Triage-Agent</guid>
    <description><![CDATA[ Sentinel-Native AI-Augmented Triage Agent Type: Cloud Security · Detection Engineering · AI Automation Stack: Microsoft Sentinel · Azure · LangGraph · Google Gemini · VirusTotal · AbuseIPDB Cost: $0 (free tier across all services) Status: v0.7.0 Active Code: sentinel-triage-agent The Problem A Tier ... ]]></description>
    <pubDate>Mon, 18 May 2026 07:54:25 GMT</pubDate>
  </item><item>
    <title>Enes Arda Baydaş</title>
    <link>https://enesardabaydas.dev/</link>
    <guid>https://enesardabaydas.dev/</guid>
    <description><![CDATA[ Building Autonomous Triage Pipelines &amp; Detection Engineering Labs Istanbul, Türkiye · Available for Tier 1 SOC Analyst Internship The Operating System I engineer proactive threat detection systems and automate the tedious layers of security operations. ]]></description>
    <pubDate>Wed, 06 May 2026 11:01:54 GMT</pubDate>
  </item><item>
    <title>Tempest IR Follina Killchain</title>
    <link>https://enesardabaydas.dev/Incident-Response/Tempest-IR-Follina-Killchain</link>
    <guid>https://enesardabaydas.dev/Incident-Response/Tempest-IR-Follina-Killchain</guid>
    <description><![CDATA[ DFIR: Tracking Follina (CVE-2022-30190) Exploitation to PrintSpoofer Privilege Escalation Date: 2026-03-27 Author: Enes Arda Baydaş Domain: Incident-Response Environment: TryHackMe (Tempest) MITRE ATT&amp;CK: T1566.001 (Spearphishing Attachment), T1203 (Exploitation for Client Execution), T1059.001 ... ]]></description>
    <pubDate>Sun, 03 May 2026 09:07:43 GMT</pubDate>
  </item><item>
    <title>Boogeyman1 Phishing DNS Exfiltration</title>
    <link>https://enesardabaydas.dev/Incident-Response/Boogeyman1-Phishing-DNS-Exfiltration</link>
    <guid>https://enesardabaydas.dev/Incident-Response/Boogeyman1-Phishing-DNS-Exfiltration</guid>
    <description><![CDATA[ DFIR: Tracking Phishing, Local Enumeration, and DNS Tunneling Exfiltration Date: 2026-04-01 Author: Enes Arda Baydaş Domain: Incident Response Environment: TryHackMe (Boogeyman 1) MITRE ATT&amp;CK: T1566.001 (Spearphishing Attachment), T1059.001 (PowerShell), T1082 (System Information Discovery), T1... ]]></description>
    <pubDate>Sun, 03 May 2026 09:05:08 GMT</pubDate>
  </item><item>
    <title>CobaltStrike and IcedID Infection</title>
    <link>https://enesardabaydas.dev/Network-Forensics/CobaltStrike-and-IcedID-Infection</link>
    <guid>https://enesardabaydas.dev/Network-Forensics/CobaltStrike-and-IcedID-Infection</guid>
    <description><![CDATA[ CobaltStrike and IcedID Infection: Network Traffic Analysis and C2 Identification Date: 2026-03-16 Author: Enes Arda Baydaş Category: Network Forensics Platform: THM/Brim MITRE ATT&amp;CK: T1071.001 (Application Layer Protocol), T1105 (Ingress Tool Transfer), T1204.002 (Malicious File) Executive Sum... ]]></description>
    <pubDate>Sun, 03 May 2026 09:05:08 GMT</pubDate>
  </item><item>
    <title>BITSAdmin LOLBin C2 Traffic in Kibana</title>
    <link>https://enesardabaydas.dev/SIEM-Hunting/BITSAdmin-LOLBin-C2-Traffic-in-Kibana</link>
    <guid>https://enesardabaydas.dev/SIEM-Hunting/BITSAdmin-LOLBin-C2-Traffic-in-Kibana</guid>
    <description><![CDATA[ SIEM Hunting: Identifying BITSAdmin LOLBin C2 Traffic in Kibana Date: 2026-03-23 Author: Enes Arda Baydaş Domain: SIEM Hunting / SOC Triage Environment: TryHackMe (ItsyBitsy) MITRE ATT&amp;CK: T1197 (BITS Jobs), T1105 (Ingress Tool Transfer), T1071.001 (Application Layer Protocol: Web Protocols) Exe... ]]></description>
    <pubDate>Sun, 03 May 2026 09:05:08 GMT</pubDate>
  </item><item>
    <title>HawkEye Keylogger</title>
    <link>https://enesardabaydas.dev/Network-Forensics/HawkEye-Keylogger</link>
    <guid>https://enesardabaydas.dev/Network-Forensics/HawkEye-Keylogger</guid>
    <description><![CDATA[ Network Forensics Analysis: HawkEye Keylogger Reborn v9 Date: May 3, 2026 Author: Enes Arda Baydaş Environment: Network PCAP (CyberDefenders HawkEye) Domain: Network Forensics MITRE ATT&amp;CK Matrix: Initial Access: T1566 (Phishing) Credential Access: T1056.001 (Keylogging), T1552.001 (Credentials ... ]]></description>
    <pubDate>Sun, 03 May 2026 07:34:17 GMT</pubDate>
  </item><item>
    <title>Atomic Red Team Emulation</title>
    <link>https://enesardabaydas.dev/Detection-Engineering/Atomic-Red-Team-Emulation</link>
    <guid>https://enesardabaydas.dev/Detection-Engineering/Atomic-Red-Team-Emulation</guid>
    <description><![CDATA[ Detection Engineering: Validating Telemetry and Telemetry Gaps via Threat Emulation Date: 2026-04-22 Author: Enes Arda Baydaş Environment: TryHackMe (Atomic Bird Goes Purple) Framework: Atomic Red Team MITRE ATT&amp;CK: T1082, T1056.002, T1091, T1552.001, T1543.003, T1491 Summary This engagement uti... ]]></description>
    <pubDate>Sun, 03 May 2026 06:54:50 GMT</pubDate>
  </item><item>
    <title>Autonomous Tier 1 Phishing Triage Pipeline</title>
    <link>https://enesardabaydas.dev/Engineering-Projects/Autonomous-Tier-1-Phishing-Triage-Pipeline</link>
    <guid>https://enesardabaydas.dev/Engineering-Projects/Autonomous-Tier-1-Phishing-Triage-Pipeline</guid>
    <description><![CDATA[ Autonomous Tier 1 Phishing Triage Pipeline Executive Summary Phishing remains the primary initial access vector for enterprise breaches. ]]></description>
    <pubDate>Sun, 03 May 2026 06:54:50 GMT</pubDate>
  </item><item>
    <title>Boogeyman2 Macro to C2 Memory Analysis</title>
    <link>https://enesardabaydas.dev/Incident-Response/Boogeyman2-Macro-to-C2-Memory-Analysis</link>
    <guid>https://enesardabaydas.dev/Incident-Response/Boogeyman2-Macro-to-C2-Memory-Analysis</guid>
    <description><![CDATA[ DFIR: Memory Analysis of Macro-Enabled Phishing and C2 Persistence Date: 2026-04-14 Author: Enes Arda Baydaş Domain: Incident Response Environment: TryHackMe (Boogeyman 2) MITRE ATT&amp;CK: Spearphishing Attachment (T1566.001), Command and Scripting Interpreter: Visual Basic (T1059.005), JavaScript ... ]]></description>
    <pubDate>Sun, 03 May 2026 06:54:50 GMT</pubDate>
  </item>
    </channel>
  </rss>