Writing by Andrew Prince.https://andrwx.com/https://andrwx.com/writing/xfang/https://andrwx.com/writing/xfang/A Chrome extension that defangs or refangs URLs, domains, IPs and email addresses right inside the text box you're typing in.Wed, 21 Oct 2026 00:00:00 GMThttps://andrwx.com/writing/ioc-recon/https://andrwx.com/writing/ioc-recon/A Chrome extension that searches every relevant threat-intel source for an indicator with a single right-click.Mon, 06 Jul 2026 00:00:00 GMThttps://andrwx.com/writing/appsindex-db/https://andrwx.com/writing/appsindex-db/AppsIndex.db is a per-user SQLite database that holds the Windows 11 Start Menu's local inventory of installed applications and their cumulative launch counts. Largely undocumented until recently, it's an alternative source of evidence worth knowing about.Thu, 23 Apr 2026 00:00:00 GMThttps://andrwx.com/writing/more-than-finding-evil/https://andrwx.com/writing/more-than-finding-evil/A common misconception about threat hunting is that its purpose is to surface adversaries hiding in your environment. That's one possible outcome, and in a healthy program, it's the rarest of the three.Mon, 20 Apr 2026 00:00:00 GMThttps://andrwx.com/writing/cbs-forensic-toolkit/https://andrwx.com/writing/cbs-forensic-toolkit/Parser for the Windows 11 Start Menu's CBS subsystem. Extracts forensic artifacts from the MicrosoftWindows.Client.CBS package: Start Menu search history, cached Bing queries, and application launch counts.Fri, 10 Apr 2026 00:00:00 GMT