Optimizing Windows VM performance on QEMU and KVM
Configuring VirtIO drivers, Hyper-V enlightenments, hybrid-core CPU pinning, hugepages, NVMe passthrough, multi-queue networking, and display tuning for Windows guests on Linux KVM.
Articles
Long-form notes built from portable Markdown and published in descending original publication order.
From Fake Shell to Real Alert: Building a Cowrie Honeypot on Azure with Microsoft Sentinel
Two Azure honeypot labs and one lesson: how the DShield sensor phoned home to SANS ISC while my own Sentinel path stayed silent, and how the cowrie-sentinel-lab pipeline works, from load balancer front door to KQL parser, detection rule, and GeoIP workbook.
Can They Tell It's Fake? A Red-Team vs Blue-Team Autopsy of My Honeypot
Honeypot detection, hands on: the AWS canary-key account-ID decode, Kippo/Cowrie protocol probes with real commands, banner-vs-handshake analysis, credential-policy statistics, persistence and forensics tests, all run against the cowrie-sentinel-lab configuration.
How Honeypots Work, from DShield to Cowrie
How honeypots actually work: the taxonomy, the DShield sensor architecture, and a walkthrough of Cowrie internals, from Twisted state machines to the virtual filesystem and credential policy.
No articles match this series yet.