Terms of use

cyfar is a personal blog about DFIR, deception, and detection. It's free to read and free to sign up. By using the site you're agreeing to the handful of things on this page.

The site

The blog is offered as-is. There is no uptime guarantee, no support contract, and no promise that any particular post will stay up forever. Posts get edited, corrected, or taken down when they need to be.

Anything published here is the operator's opinion or observation, not professional advice. If a post describes a technique, an indicator, or a tool, it's for defenders and researchers. Don't use it to attack systems you're not authorised to test.

Accounts

One account per person. Keep the credentials private. You're responsible for what happens under your account. If you think it's been used by someone else, change the password and let the operator know.

The operator may suspend or remove accounts that abuse the platform. That covers automated scraping that interferes with service, spam, harassment, and any attempt to access parts of the site you aren't supposed to.

Content

Posts, reports, and design on the site belong to the operator. Short quotes with a link back are fine, and welcome. Reposting whole pieces or republishing without permission is not.

Reports about real engagements are redacted before they go up. If something in a report looks like it identifies a specific organisation, person, or third-party tool by accident, get in touch and it'll be fixed.

Indicators and samples

Indicator lists on the site come from observations against the operator's own infrastructure. They're shared so other defenders can pivot. Treat them as leads, not as verdicts: an indicator that fits one campaign here may show up in unrelated contexts elsewhere.

Things that may change later

Paid tiers, comments, and other reader-facing features may show up in time. When they do, the relevant rules land in this page or in a clearly linked one. There is no plan to introduce anything that retroactively changes how existing posts are licensed or how existing accounts are billed.

Contact

Questions, takedown requests, or anything else, the contact form is the right path.