13Cubed

I lean red team by instinct, so 13Cubed is the channel that keeps me honest about the other side of the fight. Watching a skilled analyst reconstruct an intrusion from the MFT, registry hives, and event logs forces me to think about what my own actions actually leave behind on disk — which makes me a quieter attacker and a much better judge of what “detected” really means.

It’s also directly useful in my homelab, where I run Velociraptor, Wazuh, and Graylog for detection and log aggregation. 13Cubed’s walkthroughs on memory forensics and artifact analysis give me real technique to point those tools at, rather than just staring at a dashboard hoping something lights up. Seeing the manual, artifact-by-artifact process behind tools like KAPE and Volatility makes the automated alerts those platforms generate feel like the shortcut they are, instead of a black box.

The bigger payoff is a mental model I didn’t have before: incident response as reconstruction, not just reaction. That shift in perspective sharpens both how I defend my own lab and how I think about the traces I leave when I’m testing it.