Books

Learn to investigate Windows, Linux, macOS, memory, network, and cloud evidence with the rigor courts and regulators expect. Packed with runnable tool examples (Volatility 3, Plaso, KAPE, The Sleuth Kit) and a full worked case study, this book turns forensic theory into repeatable, defensible practice.

A vendor-neutral, hands-on guide to proactive threat hunting: the assume-breach mindset, MITRE ATT&CK, core telemetry, and techniques like baselining, beaconing, and LOLBin detection, all backed by Sigma-rule pseudocode and four full scenario hunts from phishing to command-and-control exfiltration.

A practical guide to cyber threat intelligence, from raw indicators to strategic decisions. Learn the intelligence lifecycle, MITRE ATT&CK, STIX/TAXII/MISP, and intelligence-driven threat hunting, all traced through one real phishing campaign from first alert to CISO briefing.

Tens of thousands of vulnerabilities. A handful that actually matter. This book shows you how to build a risk-based vulnerability management program, from asset discovery and scanning to CVSS/EPSS/KEV prioritization, remediation workflows, cloud and container security, and zero-day response, complete with SLA matrices, scoring formulas, and a full Log4Shell case study.

A practical, hands on guide that walks SOC analysts, incident responders, and aspiring reverse engineers from a suspicious file to a defensible detection, covering static, dynamic, code, and memory analysis, unpacking, YARA, and real world reporting.

Running incidents is a technical problem under time pressure. Running the team that handles them is an organizational design problem, and most CSIRTs fail at exactly that gap. This handbook gives security leaders the charters, catalogs, playbooks, RACIs, and war room templates to build a CSIRT that survives its first real crisis, and the next one.

Prompt injection is the SQL injection of the AI era — and most LLM apps are wide open. This hands-on field manual shows application security engineers how to attack and defend LLM systems: direct, indirect, multimodal, and agentic injection, with working code, labs, and ASR benchmarks you can run in CI. Break it, then build the defense-in-depth that holds in production.

A practitioner's guide to running a modern SOC, from alert triage and detection engineering to SOAR automation and metrics that actually mean something. Includes real Sigma and KQL rules, a triage checklist, an escalation matrix, and a full worked phishing case from alert to closure.

Cyber threats evolve constantly, and effective defense starts with actionable intelligence. This book guides you from the fundamentals of cyber threat intelligence to advanced operational practices, providing practical frameworks, real-world examples, and proven techniques to help you turn threat data into stronger security decisions.

Discover how Windows really works beneath the desktop. From boot to shutdown, this book provides a practical, in-depth exploration of the Windows NT kernel, covering architecture, memory management, security, virtualization, debugging, and more for developers, security professionals, and advanced students.

Master the art of binary analysis with Practical Binary Analysis with Capstone & Keystone. Learn how to disassemble, assemble, analyze, and rewrite machine code while building real-world tools for reverse engineering, security research, and automation.

모든 크립토 채널에는 같은 다급한 경고가 고정되어 있습니다. "운영진은 절대 먼저 DM을 보내지 않습니다." 이 책은 그 한 줄 뒤에 숨은 스캠 경제의 필드 가이드입니다. 사칭 관리자, 딥페이크로 만들어진 창업자, 피그 부처링, 통째로 합성된 커뮤니티까지 — 스팸에서 크립토, 그리고 AI로 이어지는 세 시대를 가로질러 추적하고, 이 모든 것을 끝낼 단 하나의 질문에 도달합니다. 지금 이 방에 누가 있는가?

脅威 → コントロール → 要件 → 検証。AIエージェントを出荷する前に読むフィールドマニュアル。

Endpoint Detection and Response is at the core of modern cybersecurity. This book explores the technologies behind EDR, from kernel-level telemetry to threat hunting and zero-trust architectures, providing practical guidance for deploying and operating EDR at scale.

Machine identities outnumber humans 82:1 in modern cloud environments. Every IAM role, every OIDC federation from your CI/CD pipeline, every service account — they accumulate silently. No one monitors them. No one audits them. Each one is a potential entry point for attackers. This book shows you how to build the platform that makes them visible.