Dispatch Debrief: September 2025

Baselines: the thrunter’s compass. Here’s how we used them this month.

September had us thrunting through baselines, browser chaos, and fresh hunts. From calling out shady plugins to mapping what “normal” even means, the Dispatch dropped six posts that prove: normal is overrated, weird is where the hunt starts.

• You Can’t Find Weird If You Don’t Know Normal
  Baselining is the bedrock of hunting. Temporal, volume, behavioral, network, and process baselines let you map “normal” so you can spot “weird.” Start small, add context, update often. That’s how you catch threats instead of hoping.
  By Sydney Marrone

• Can’t Hide in 3D
  The Time–Terrain–Behavior (TTB) framework turns logs into a 3D landscape. Outliers pop, threats stand out, and hunts get sharper. Because sometimes flat just doesn’t cut it.
  By Certis Foster

• Ask-a-Thrunt3r: August 2025 Recap 🐏
  Hacker Summer Camp highlights, evolving attack vectors, hunting strategies beyond Splunk, and community wins. The energy is real—this episode proves thrunting is thriving.
  By Lauren Proehl

• Even if many plugins are fine, the bad ones are BAD
  Browser extensions = sneaky risk. Audit installs, check manifests, scan with YARA, and lean on tools like Secure Annex. Because one bad plugin can wreck your day.
  By John Tuckner

• Beyond Hackers in Hoodies: A Project Manager’s Move into Cybersecurity
  From features to risk reduction: how project managers shift into security. Skills like risk management and stakeholder wrangling translate directly. Hoodies optional.
  By Courtney Shar

• Baseline Bonanza: Ten Baseline Hunts You Should Do (and How to Do Them)
  Ten must-run baseline hunts to make “normal” visible, catch abnormal fast, and build repeatable processes that strengthen your posture every week.
  By Lauren Proehl

Stay tuned for more thrunting wisdom next month.