> For the complete documentation index, see [llms.txt](https://blog.securehat.co.uk/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.securehat.co.uk/detection-experiments.md).

# Detection Experiments

- [Detecting Parent Process Spoofing using KrabsETW](https://blog.securehat.co.uk/detection-experiments/detecting-parent-process-spoofing-using-krabsetw.md): This blog post covers how to build a simple PoC program that will use the KrabsETW library to subscribe to an ETW provider in order to detect parent process spoofing.
- [Chainsaw Tool - Search and Hunt Through Event Logs](https://blog.securehat.co.uk/detection-experiments/chainsaw-tool-search-and-hunt-through-event-logs.md): A few months ago I wrote a tool in my day job that helps analysts to search and hunt through Windows Event Logs. The relevant blog post and tool links are below.
- [Hunting for C3 Activity](https://blog.securehat.co.uk/detection-experiments/hunting-for-c3-activity.md)