An insider insights into Conti operations – Part two

This blog post analyzes leaked Conti operator manuals and demonstrates practical detection rules for their observed techniques — including disabling Windows Defender via PowerShell, dumping NTDS.dit from Volume Shadow Copies, domain discovery with nltest and net commands, data exfiltration using Rclone, and Cobalt Strike C2 infrastructure — with guidance for Windows/Sysmon event-based detection and references to Sigma rules.