- JonMon
- JonMon-Lite
- EtwInspector
- EtwWatcher
- EventSight
- TelemetrySource
- MSRPC-to-ATTACK
- PowerParse
- MSFT_DriverBlockList
- The Defenders Guide (Co-Author)
Blogs can be found here: https://jonny-jhnson.dev/
- Mastering Windows Access Control: Understanding SeDebugPrivilege
- Exploring Token Members Part 1
- Exploring Token Members Part 2
- Changing a Primary Token's Session ID
- Exploring Impersonation through the Named Pipe Filesystem Driver
- Windows ProjFS Internals: A Technical Deep Dive
- WSL, COM Hooking, & RTTI
- Event Tracing for Windows (ETW): Your Friendly Neighborhood IPC Mechanism
- The Client/Server Relationship — A Match Made in Heaven
- The Defender's Guide to Windows Services
- Demystifying DLL Hijacking: Understanding the Intricate World of Dynamic Link Library Attacks
- A Voyage to Uncovering Telemetry: Identifying RPC Telemetry for Detection Engineers (research paper)
- The Truth About Telemetry: The Role of Primary and Secondary Telemetry Sources
- Telemetry Layering
- Understanding Telemetry: Kernel Callbacks
- Utilizing RPC Telemetry
- What the Fork: Exploring Telemetry Gaps in Microsoft's 4688 Event
- Refining Detection: New Perspectives on ETW Patching Telemetry
- Uncovering Window Events series:
- EtwWatcher
- Behind the Mask: Unpacking Impersonation Events
- Better Know a Data Source series:
- Dataset Prioritization
- Abstracting Scheduled Tasks
- The Dark Side of Microsoft Remote Procedure Call Protocols
- Uncovering Adversarial LDAP Tradecraft
- Defending the Three-Headed Relay
- Bypassing Access Mask Auditing Strategies
- Silencing the EDR Silencers
- No Agent, No Problem: Discovering Remote EDR
- Peeling Back the Mask: How the Threat Intelligence Provider is Protected
- Understanding ETW Patching
- Evadere Classifications
- ThreadSleeper: Suspending Threads via GMER64 Driver
- A Deep Dive into Codex Windows Sandbox
- RAG, ICL, and Windows Events: Building a Human-Guided Security Analyst
- A Voyage to Uncovering RPC Telemetry — SO-CON 2020
- Understanding Technique Abstraction for Detection Engineers Workshop — SO-CON 2020
- MSRPC ATT&CK Mapping — EU MITRE 8th Workshop
- Insights into Highly Valued Data Sources — ATT&CKcon 3.0 (2022)
- Once Upon A Login: How Logon Sessions Help Defenders See the Bigger Picture (2022)
- Mapping Detection Coverage — DEATHCon 2022
- JonMon
- Empowering Research with Defensive Tooling



