Mheboobkhan Pathan is a Senior Threat Hunter at Microsoft with 9+ years of experience in threat hunting and incident response. Writing on probability, Bayesian inference, and hunting.https://mheboobkhan.github.io/https://mheboobkhan.github.io/me/blog/probabilistic-threat-hunting/pth-chapter-4-mathematical-modeling-for-threat-hunting/https://mheboobkhan.github.io/me/blog/probabilistic-threat-hunting/pth-chapter-4-mathematical-modeling-for-threat-hunting/A Bayesian approach to learning from alerts: priors, likelihoods, posterior updates, and predictions for SOC detection rules.Fri, 16 Oct 2026 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/ciso-ciso-what-s-your-privacy-budget/https://mheboobkhan.github.io/me/blog/technical-writing/ciso-ciso-what-s-your-privacy-budget/Learn about the fundamentals of LLM privacy.Sun, 23 Aug 2026 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/practical-prompt-injections/https://mheboobkhan.github.io/me/blog/technical-writing/practical-prompt-injections/IntroductionSat, 25 Jul 2026 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/probabilistic-threat-hunting/pth-chapter-3-baselining-and-probabilistic-threat-hunting/https://mheboobkhan.github.io/me/blog/probabilistic-threat-hunting/pth-chapter-3-baselining-and-probabilistic-threat-hunting/“Say, observe what is in the heavens and the earth.”– Quran 10:101Thu, 25 Jun 2026 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/probabilistic-threat-hunting/pth-chapter-2-foundations-of-probability-for-threat-hunting/https://mheboobkhan.github.io/me/blog/probabilistic-threat-hunting/pth-chapter-2-foundations-of-probability-for-threat-hunting/“Indeed, all things We created with precise measure.” — Quran 54:49Mon, 01 Jun 2026 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/probabilistic-threat-hunting/probabilistic-hunting-chapter-1-where-two-seas-meets/https://mheboobkhan.github.io/me/blog/probabilistic-threat-hunting/probabilistic-hunting-chapter-1-where-two-seas-meets/“And it is He who has released the two seas, one fresh and sweet and one salty and bitter” — — Quran 25:53Mon, 18 May 2026 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/add-context-to-your-emacs-second-brain-using-ai-for-0/https://mheboobkhan.github.io/me/blog/technical-writing/add-context-to-your-emacs-second-brain-using-ai-for-0/At night, when the town falls asleep and the streets become empty, there arises an urge — like the scream of a beast in a valley — to seek…Sat, 18 Apr 2026 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/setup-your-threat-hunting-lab-in-30-mins/https://mheboobkhan.github.io/me/blog/technical-writing/setup-your-threat-hunting-lab-in-30-mins/It’s been almost a decade since I started working in the cybersecurity industry, and one question I keep getting asked is:Sun, 29 Mar 2026 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/how-i-developed-a-memory-system-to-remember-almost-anything/https://mheboobkhan.github.io/me/blog/technical-writing/how-i-developed-a-memory-system-to-remember-almost-anything/A strange individual approaches Dr. Tenma to inquire about the recent murders. He introduces himself as Inspector Lunge from the BKA…Sat, 30 Aug 2025 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/how-to-sell-your-potatoes-mathematically/https://mheboobkhan.github.io/me/blog/technical-writing/how-to-sell-your-potatoes-mathematically/In this universe of billions of stars and planets, Mr.X is only concerned about one thing — how to increase the sale of his potatoes.Sun, 10 Aug 2025 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/unsupervised-text-classification-in-powershell-part-1/https://mheboobkhan.github.io/me/blog/technical-writing/unsupervised-text-classification-in-powershell-part-1/Text classification or text analysis is one of the growing fields in the IT world. Cyber Security is not an exception, especially in…Sun, 17 Oct 2021 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/the-threat-hunting-hypothesis-defined/https://mheboobkhan.github.io/me/blog/technical-writing/the-threat-hunting-hypothesis-defined/Human intelligence gives us the liberty of interpreting things as per our own will and understanding. This is the drawback of our…Sun, 10 Oct 2021 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/simple-darkweb-monitoring-bot-with-telegram/https://mheboobkhan.github.io/me/blog/technical-writing/simple-darkweb-monitoring-bot-with-telegram/One of the aspects of threat hunting is to look for data breaches and leaks that happen on the dark web. Good threat hunter keeps looking…Sun, 29 Aug 2021 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/re-loaded-thm-rooms-hints/https://mheboobkhan.github.io/me/blog/technical-writing/re-loaded-thm-rooms-hints/RE-loaded : THM Room Write Up  Hi Folk i have created room for zero-hero RE challenge room on THM. Currently room is hosting on 4…Sun, 10 Jan 2021 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/shellcoding-the-syscall-dilemma/https://mheboobkhan.github.io/me/blog/technical-writing/shellcoding-the-syscall-dilemma/Shellcoding or simply exploit writing depends heavily the on syscall or system call for their success. OS architecture is designed in such…Sat, 14 Nov 2020 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/token-impersonation-privesc-c-code/https://mheboobkhan.github.io/me/blog/technical-writing/token-impersonation-privesc-c-code/It was suppose to be a part of my malware programming series but unfortunately i am unable to create a whole blog series. Never minds lest…Sat, 10 Oct 2020 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/quick-dfir-th-file-system-tunneling/https://mheboobkhan.github.io/me/blog/technical-writing/quick-dfir-th-file-system-tunneling/Hello, every one writing after a long time . This time i have decided to brief you all about interesting concepts of the DFIR and TH very…Sat, 11 Jul 2020 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/bro-log-file-analysis-using-python-and-pandas/https://mheboobkhan.github.io/me/blog/technical-writing/bro-log-file-analysis-using-python-and-pandas/In the world of cybersecurity, we have multiple Dimensions to deal with. Among this, there is a log analysis, which is a crucial part of…Sun, 16 Feb 2020 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/0x00-basics-of-reverse-engineering-stack/https://mheboobkhan.github.io/me/blog/technical-writing/0x00-basics-of-reverse-engineering-stack/I fell in love of reverse engineering after watching a video of buffer overflow exploit explanation by computerphile. They have explained…Mon, 23 Sep 2019 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/netcat-cache-level-attacks-explained/https://mheboobkhan.github.io/me/blog/technical-writing/netcat-cache-level-attacks-explained/Cache attacks are one of the mots formidable attacks ever developed againts any system, recent progress In this class of attacks made it…Wed, 18 Sep 2019 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/retrieving-files-from-memory-dump/https://mheboobkhan.github.io/me/blog/technical-writing/retrieving-files-from-memory-dump/That’s gonna short but i think you will enjoy it.Wed, 11 Sep 2019 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/top-linux-utilities-for-reverse-engineering/https://mheboobkhan.github.io/me/blog/technical-writing/top-linux-utilities-for-reverse-engineering/Forensics and reverse engineering all is about learning how the code works.To understand the inner workings of the code we first should…Tue, 03 Sep 2019 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/emotet-memory-dump-analysis-part-1-detecting-malicious-processes/https://mheboobkhan.github.io/me/blog/technical-writing/emotet-memory-dump-analysis-part-1-detecting-malicious-processes/In my last blog I have shared some behavioural analysis of emotet malware sample, perhaps we concluded that given sample is emotet sample…Thu, 09 May 2019 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/malware-news-24-29-march/https://mheboobkhan.github.io/me/blog/technical-writing/malware-news-24-29-march/It’s been a very hot week for Malware industrie from Locker Goga to the Shadow Hammer. Let’s take a look of latest updates in the world of…Fri, 29 Mar 2019 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/malware-bulletin-week-1-1st-march-8th-march-2019/https://mheboobkhan.github.io/me/blog/technical-writing/malware-bulletin-week-1-1st-march-8th-march-2019/Here are the top news of the week in malware landscape.Sat, 09 Mar 2019 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/dynamic-analysis-of-watchdog-spyware/https://mheboobkhan.github.io/me/blog/technical-writing/dynamic-analysis-of-watchdog-spyware/In my hunt of malware i accidentally come across the the file called as Watchdog.exe . I decided to dissect this file to uncover it. At…Fri, 01 Mar 2019 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/top-5-ways-to-detect-malicious-file-manually/https://mheboobkhan.github.io/me/blog/technical-writing/top-5-ways-to-detect-malicious-file-manually/If you are not security professional and no idea what malware's can do to you and how you can tell if the file is malicious or not this is…Sun, 17 Feb 2019 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/dynamic-malware-analysis-lab-setup/https://mheboobkhan.github.io/me/blog/technical-writing/dynamic-malware-analysis-lab-setup/Malware analysis is tricky business . If you do not take care of how we are analyzing our malware samples then we might ended up in…Fri, 15 Feb 2019 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/entropy-analysis-a-critical-test-for-malware-s/https://mheboobkhan.github.io/me/blog/technical-writing/entropy-analysis-a-critical-test-for-malware-s/while working on Detect it easy or simply DIE I noticed one tab of this tool called as Entropy. This tab was simply design to show an…Tue, 12 Feb 2019 00:00:00 GMThttps://mheboobkhan.github.io/me/blog/technical-writing/basic-static-malware-analysis-pe-viewer-depnd-walker-die/https://mheboobkhan.github.io/me/blog/technical-writing/basic-static-malware-analysis-pe-viewer-depnd-walker-die/Malware are the most fearful aspect for any security professional. Specially when your AV solutions are lame enough to release signatures…Sun, 10 Feb 2019 00:00:00 GMT