Security on MEISTSEChttps://44e06765.meistsec-blog.pages.dev/tags/security/Recent content in Security on MEISTSECHugoen-usFri, 21 Aug 2026 00:00:00 +0000Read the Lease: From a Firewall Log to a Twelve-Membership LIR Farmhttps://44e06765.meistsec-blog.pages.dev/posts/lease/Fri, 21 Aug 2026 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/posts/lease/Eleven IPs scanned my WAN. My firewall said Iran, but the servers were in Amsterdam. Following the address space led to twelve RIPE LIR memberships sharing one company registration number, while several of my own threat-hunting heuristics failed along the way.From Alerts to Answers: Building Threat Meister, a Monthly Threat-Hunting Workflowhttps://44e06765.meistsec-blog.pages.dev/posts/threatmeister/Fri, 17 Jul 2026 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/posts/threatmeister/Part two of the malware lab series. The KVM lab generates a firehose of Wazuh alerts — Threat Meister is the terminal tool that turns them into a signed, scored, monthly threat-hunting report by cross-referencing them against VirusTotal and your own malware catalog.Building a Professional KVM Malware Analysis Lab on Linuxhttps://44e06765.meistsec-blog.pages.dev/posts/malwarelab/Fri, 10 Jul 2026 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/posts/malwarelab/A complete walkthrough of building a production-grade malware analysis environment using KVM, PFSense, Remnux, FLARE-VM, Mullvad WireGuard VPN, mitmproxy TLS interception, and Wazuh SIEM — inspired by c3rb3ru5d3d53c's approach.How I Hunted the Atomic Arch AUR Stealer on My Own Boxhttps://44e06765.meistsec-blog.pages.dev/posts/arch_threat_hunt/Mon, 15 Jun 2026 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/posts/arch_threat_hunt/When 400+ Arch AUR packages got hijacked to drop a Rust credential stealer with an optional eBPF rootkit, I ran the full hunt against my own Arch box. Spoiler: clean — but two checks looked like hits and weren't, providing a good lessons learned experience.How I Chased a BPFDoor Backdoor in My Robot Vacuum (And Found a Microsecond Timer)https://44e06765.meistsec-blog.pages.dev/posts/vacuum/Mon, 18 May 2026 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/posts/vacuum/A week-long investigation into a Suricata IDS alert for BPFDoor backdoor activity on a Roborock Q10 vacuum. Spoiler: it wasn't BPFDoor. The actual cause is more interesting — and reproducible.Firewall Configurationshttps://44e06765.meistsec-blog.pages.dev/posts/firewall/firewall_configurations/Tue, 19 Apr 2022 14:24:57 -0500https://44e06765.meistsec-blog.pages.dev/posts/firewall/firewall_configurations/Hardening firewalld on Fedora Workstation for a security research host.