DIO

We release open source detection rules and tools so that people without a budget can still defend themselves. It’s the spirit behind a lot of community work: help others stand a chance, even without a SOC, a commercial EDR, or a red team to simulate threats. So it always feels a bit off when I see a project that collects all those open source detections and analysis tools, wraps them in a nice interface, and then advertises itself as a way to "perfect your tradecraft" without triggering alerts. What it really does is help you test and tune your payloads until they don’t get detected by public tooling. And that public tooling is often all some orgs have. It doesn’t help attackers evade everything. It helps them evade exactly the stuff that was made freely available to level the playing field. That’s the part I dislike. Quietly. Not because it’s illegal or poorly engineered - but because it erodes the value of what many people work hard to provide for free. Just something I think more people should be aware of.