https://www.veil-framework.com/component---src-components-page-tem…ctivity-in-logs-mdx-dc1d53651a2c1f181b05.js

1"use strict";(self.webpackChunkveil_framework=self.webpackChunkveil_framework||[]).push([[6530],{4500:function(e,t,n){n.r(t),n.d(t,{Head:function(){return p},default:function(){return h}});var l=n(8453),a=n(6540);function r(e){const t=Object.assign({h1:"h1",p:"p",a:"a",h2:"h2",ol:"ol",li:"li",strong:"strong",h3:"h3",ul:"ul",code:"code",hr:"hr",em:"em"},(0,l.RP)(),e.components);return a.createElement(a.Fragment,null,a.createElement(t.h1,null,"Blue Team Monitoring: Detecting Veil Framework Activity in Logs"),"\n",a.createElement(t.p,null,"If you are a blue team analyst, SOC operator, or detection engineer, you will eventually encounter payloads generated by the ",a.createElement(t.a,{href:"/framework/"},"Veil Framework")," — either in authorized purple team exercises or in real incidents where adversaries use similar techniques. Understanding what Veil-generated activity looks like in your logs, SIEM, and endpoint telemetry is the difference between catching the test and missing the real thing."),"\n",a.createElement(t.p,null,"This article provides a practitioner-focused guide to detecting Veil Framework activity across the full kill chain: payload generation artifacts, delivery indicators, execution telemetry, post-exploitation behavior, and the evasion techniques that make each stage harder to detect."),"\n",a.createElement(t.h2,null,"What You Are Looking For"),"\n",a.createElement(t.p,null,"Veil Framework payloads do not have a single, universal signature. The framework's purpose is evasion — generating payloads that avoid signature-based detection. Instead of looking for a specific hash or string, you need to detect the behavioral patterns that Veil payloads share with real-world threats."),"\n",a.createElement(t.p,null,"The detection model has four phases:"),"\n",a.createElement(t.ol,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Delivery")," — How the payload reaches the target"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Execution")," — How the payload runs and establishes itself"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Post-exploitation")," — What the payload does after execution"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Evasion artifacts")," — What the obfuscation and evasion techniques leave behind"),"\n"),"\n",a.createElement(t.h2,null,"Phase 1: Delivery Detection"),"\n",a.createElement(t.p,null,"Veil payloads can be delivered through any mechanism. The common lab delivery paths — and their log signatures — include:"),"\n",a.createElement(t.h3,null,"Email/Web Delivery"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Proxy logs")," — HTTP requests downloading executable or script files. Pay attention to User-Agent strings, download source domains, and file types."),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Email gateway logs")," — Attachments with suspicious file types, links to recently registered domains."),"\n"),"\n",a.createElement(t.h3,null,"Network Delivery (via ",a.createElement(t.a,{href:"/catapult/"},"Catapult"),")"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"SMB Event ID 5145")," — Share access for payload transfer. Alert on access to C$ and ADMIN$ shares from non-administrative workstations."),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"WMI Event IDs 5857-5861")," — Remote process execution through WMI."),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Service creation Event ID 7045")," — New services registered for payload execution."),"\n"),"\n",a.createElement(t.p,null,"For the complete delivery detection surface, the ",a.createElement(t.a,{href:"/automating-payload-delivery-with-veil-catapult-multi-stage-pipelines/"},"Catapult delivery pipelines article")," maps each mechanism to specific telemetry sources."),"\n",a.createElement(t.h3,null,"LOLBAS Delivery"),"\n",a.createElement(t.p,null,"Veil payloads delivered via living-off-the-land binaries:"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"certutil.exe")," with ",a.createElement(t.code,null,"-urlcache -split -f")," and an external URL"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"bitsadmin.exe")," creating transfer jobs"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"mshta.exe")," executing remote HTA content"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"powershell.exe")," with download cradle patterns"),"\n"),"\n",a.createElement(t.p,null,"See the ",a.createElement(t.a,{href:"/living-off-the-land-binaries-lolbas-in-2026-techniques-and-detection/"},"LOLBAS detection article")," for comprehensive detection rules."),"\n",a.createElement(t.h2,null,"Phase 2: Execution Detection"),"\n",a.createElement(t.h3,null,"PowerShell-Based Payloads"),"\n",a.createElement(t.p,null,"Veil generates several PowerShell payload types. Detection opportunities:"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,"\n",a.createElement(t.p,null,a.createElement(t.strong,null,"Script Block Logging (Event ID 4104)")," — The decoded payload content. Look for:"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,"Base64-encoded content being decoded"),"\n",a.createElement(t.li,null,".NET reflection (",a.createElement(t.code,null,"[Reflection.Assembly]::Load"),")"),"\n",a.createElement(t.li,null,"Shellcode allocation patterns (",a.createElement(t.code,null,"VirtualAlloc"),", ",a.createElement(t.code,null,"CreateThread"),")"),"\n",a.createElement(t.li,null,"AMSI bypass attempts"),"\n",a.createElement(t.li,null,"Network connection establishment"),"\n"),"\n"),"\n",a.createElement(t.li,null,"\n",a.createElement(t.p,null,a.createElement(t.strong,null,"Process creation (Sysmon Event ID 1)")," — PowerShell launched with:"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.code,null,"-EncodedCommand")," or ",a.createElement(t.code,null,"-enc")," arguments"),"\n",a.createElement(t.li,null,a.createElement(t.code,null,"-ExecutionPolicy Bypass")),"\n",a.createElement(t.li,null,a.createElement(t.code,null,"-NoProfile -WindowStyle Hidden")),"\n",a.createElement(t.li,null,"Pipe from another process (",a.createElement(t.code,null,"cmd.exe | powershell"),")"),"\n"),"\n"),"\n"),"\n",a.createElement(t.p,null,"The ",a.createElement(t.a,{href:"/powershell-best-practices-reducing-attack-surface-against-advanced-payloads/"},"PowerShell hardening guide")," details the monitoring configuration."),"\n",a.createElement(t.h3,null,"Compiled Payloads (C, C#, Go, Python)"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"File creation (Sysmon Event ID 11)")," — New executables in user-writable directories (Downloads, Temp, AppData)"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Process creation (Sysmon Event ID 1)")," — Unsigned executables, executables running from unusual paths, or executables with suspicious parent processes"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Code signing verification")," — Unsigned or self-signed executables in environments that expect signed software"),"\n"),"\n",a.createElement(t.h3,null,"Python-Based Payloads (",a.createElement(t.a,{href:"/pyherion/"},"Pyherion"),"-obfuscated)"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Python interpreter spawning")," — ",a.createElement(t.code,null,"python.exe")," or ",a.createElement(t.code,null,"pythonw.exe")," launched with script arguments from unexpected paths"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,a.createElement(t.code,null,"exec()")," and ",a.createElement(t.code,null,"compile()")," usage")," — If Python execution logging is available, these function calls indicate dynamic code execution"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Standalone Python executables")," — PyInstaller-packaged payloads create temporary directories during extraction; monitor for PyInstaller extraction paths"),"\n"),"\n",a.createElement(t.p,null,"For obfuscation-specific detection, see the ",a.createElement(t.a,{href:"/unleashing-pyherion-modern-python-obfuscation-for-red-teams-2026/"},"Pyherion obfuscation article"),"."),"\n",a.createElement(t.h2,null,"Phase 3: Post-Exploitation Detection"),"\n",a.createElement(t.p,null,"After a Veil payload executes successfully, the post-exploitation phase generates significant telemetry:"),"\n",a.createElement(t.h3,null,"Process Injection"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Sysmon Event ID 8")," (CreateRemoteThread) — Remote thread creation in another process"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Sysmon Event ID 10")," (ProcessAccess) — Cross-process handle acquisition with write/execute permissions"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Memory allocation patterns")," — ",a.createElement(t.code,null,"PAGE_EXECUTE_READWRITE")," allocations in processes that should not have them"),"\n"),"\n",a.createElement(t.p,null,"The ",a.createElement(t.a,{href:"/why-process-injection-t1055-dominates-2026-attack-trends/"},"process injection trends article")," covers the full detection surface."),"\n",a.createElement(t.h3,null,"Credential Acce

1ss"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"LSASS access")," — Sysmon Event ID 10 targeting lsass.exe"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Registry extraction")," — ",a.createElement(t.code,null,"reg.exe save")," targeting SAM, SYSTEM, or SECURITY hives"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Kerberoasting")," — Unusual TGS requests (Event ID 4769) with RC4 encryption"),"\n"),"\n",a.createElement(t.p,null,"The ",a.createElement(t.a,{href:"/veil-pillage-harvesting-credentials-and-lateral-movement-techniques/"},"Veil-Pillage credential harvesting article")," maps these techniques to specific detections."),"\n",a.createElement(t.h3,null,"Network Activity"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Sysmon Event ID 3")," (NetworkConnect) — Outbound connections from payload processes to C2 infrastructure"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"DNS queries")," — Resolution of C2 domains from unexpected processes"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Beaconing patterns")," — Regular interval connections to the same destination"),"\n"),"\n",a.createElement(t.h3,null,"Active Directory Reconnaissance"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"LDAP query volume")," — Bursts of LDAP queries from a single endpoint"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"PowerView function calls")," — Script Block Log entries with AD enumeration patterns"),"\n"),"\n",a.createElement(t.p,null,"The ",a.createElement(t.a,{href:"/mastering-veil-powerview-active-directory-reconnaissance-techniques-2026/"},"PowerView reconnaissance article")," covers AD-specific detection."),"\n",a.createElement(t.h2,null,"Phase 4: Evasion Artifact Detection"),"\n",a.createElement(t.p,null,"Veil's evasion techniques leave their own detectable traces:"),"\n",a.createElement(t.h3,null,"AMSI Bypass"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Script Block Log")," — The bypass code itself is often logged before AMSI is disabled. Search for patterns: ",a.createElement(t.code,null,"amsiInitFailed"),", ",a.createElement(t.code,null,"AmsiScanBuffer"),", ",a.createElement(t.code,null,"AmsiUtils")),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"ETW provider modification")," — Patching of ETW providers to disable telemetry"),"\n"),"\n",a.createElement(t.h3,null,"Sandbox Detection"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"API call patterns")," — Calls to ",a.createElement(t.code,null,"GetCursorPos"),", ",a.createElement(t.code,null,"GetLastInputInfo"),", ",a.createElement(t.code,null,"Win32_DiskDrive")," WMI queries early in execution indicate sandbox awareness"),"\n",a.createElement(t.li,null,"See the ",a.createElement(t.a,{href:"/self-aware-malware-outsmarting-sandboxes-with-human-like-behavior/"},"sandbox evasion article")),"\n"),"\n",a.createElement(t.h3,null,"Encryption and Obfuscation"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"High entropy payloads")," — Encrypted or heavily obfuscated payloads have measurably high entropy"),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Decryption-before-execution patterns")," — Memory allocation followed by a compute-intensive loop followed by execution transfer"),"\n",a.createElement(t.li,null,"See the ",a.createElement(t.a,{href:"/chaos-encryption-next-generation-shellcode-obfuscation-to-bypass-av/"},"chaos encryption article")),"\n"),"\n",a.createElement(t.h2,null,"Building a Detection Dashboard"),"\n",a.createElement(t.p,null,"For continuous monitoring, build a SIEM dashboard that tracks:"),"\n",a.createElement(t.p,null,"| Panel | Data Source | Purpose |\n|---|---|---|\n| PowerShell suspicious commands | Event ID 4104 | Real-time script content monitoring |\n| LSASS access events | Sysmon Event ID 10 | Credential access attempts |\n| New service creation | Event ID 7045 | Payload delivery via services |\n| Unsigned executable launches | Sysmon Event ID 1 + code signing | Unknown payload execution |\n| Cross-process injection | Sysmon Event IDs 8, 10 | Process injection activity |\n| Unusual network connections | Sysmon Event ID 3 | C2 communication |\n| AMSI bypass indicators | Event ID 4104 | Evasion attempts |"),"\n",a.createElement(t.h2,null,"Practical Workflow for Purple Team Exercises"),"\n",a.createElement(t.p,null,"When your red team runs Veil Framework exercises:"),"\n",a.createElement(t.ol,null,"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Pre-exercise")," — Verify all logging is functional. Check that Sysmon, PowerShell logging, and event forwarding are working."),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"During exercise")," — Monitor the dashboard in real time. Note which phases generate alerts and which do not."),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Post-exercise")," — Conduct a comprehensive log review. Identify every action the red team took and verify that corresponding telemetry exists."),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Gap analysis")," — For any red team action without corresponding telemetry, investigate the logging gap and remediate."),"\n",a.createElement(t.li,null,a.createElement(t.strong,null,"Rule development")," — Build or refine detection rules for identified gaps. Test them in the ",a.createElement(t.a,{href:"/defensive-lab-guide-safely-analyzing-veil-payloads-in-a-sandbox/"},"lab environment"),"."),"\n"),"\n",a.createElement(t.h2,null,"Related Reading"),"\n",a.createElement(t.ul,null,"\n",a.createElement(t.li,null,a.createElement(t.a,{href:"/framework/"},"Veil Framework Overview")),"\n",a.createElement(t.li,null,a.createElement(t.a,{href:"/framework/veil-evasion/"},"Veil-Evasion Module")),"\n",a.createElement(t.li,null,a.createElement(t.a,{href:"/catapult/"},"Veil-Catapult Module")),"\n",a.createElement(t.li,null,a.createElement(t.a,{href:"/powershell-payloads/"},"PowerShell Payloads in Security Testing")),"\n",a.createElement(t.li,null,a.createElement(t.a,{href:"/why-process-injection-t1055-dominates-2026-attack-trends/"},"Why Process Injection (T1055) Dominates 2026 Attack Trends")),"\n",a.createElement(t.li,null,a.createElement(t.a,{href:"/veil-pillage-harvesting-credentials-and-lateral-movement-techniques/"},"Veil-Pillage: Credential Harvesting")),"\n",a.createElement(t.li,null,a.createElement(t.a,{href:"/guides/"},"Guides and Tutorials")),"\n"),"\n",a.createElement(t.hr),"\n",a.createElement(t.p,null,a.createElement(t.em,null,"Your logs tell the story of every attack — if you are collecting the right telemetry and know what patterns to look for. The Veil Framework generates the activity. Your SIEM must catch it. Test, validate, iterate.")))}var c=function(e={}){const{wrapper:t}=Object.assign({},(0,l.RP)(),e.components);return t?a.createElement(t,e,a.createElement(r,e)):r(e)},i=n(9329),o=n(1744),s=n(8963),m=n(8752),u=n(7304);function d(e){if(!e)return null;try{return new Intl.DateTimeFormat("en-GB",{day:"numeric",month:"long",year:"numeric",timeZone:"UTC"}).format(new Date(e))}catch{return null}}function E({pageContext:e,children:t}){const{frontmatter:n}=e,l=(null==n?void 0:n.title)||"",r=(null==n?void 0:n.description)||"",c=(null==n?void 0:n.slug)||"",o=(null==n?void 0:n.heroImage)||null,E=(null==n?void 0:n.date)||null,h=(null==n?void 0:n.lastmod)||null,p=d(E),g=h&&h!==E?d(h):null;return a.createElement(i.A,null,o&&a.createElement(s.A,{title:l,subt

1itle:r,backgroundImage:o}),a.createElement("article",{className:"page-content"},a.createElement("div",{className:"container"},p&&a.createElement("p",{className:"post-meta"},a.createElement("time",{dateTime:E},"Published ",p),g&&a.createElement(a.Fragment,null," · ",a.createElement("time",{dateTime:h},"Updated ",g))),a.createElement("div",{className:"post-layout-grid"},a.createElement("div",{className:"post-main"},t),a.createElement("aside",{className:"post-sidebar","aria-label":"Sidebar"},a.createElement("div",{className:"post-sidebar-scroll"},a.createElement(u.A),a.createElement(m.A,{sourceUrl:c})))))))}function h(e){return a.createElement(E,e,a.createElement(c,e))}function p({pageContext:e}){const{frontmatter:t}=e,n=null!=t&&t.heroImage?`https://www.veil-framework.com${t.heroImage}`:null;return a.createElement(o.A,{title:null==t?void 0:t.title,description:null==t?void 0:t.description,pathname:null==t?void 0:t.slug},(null==t?void 0:t.date)&&a.createElement("meta",{property:"article:published_time",content:t.date}),(null==t?void 0:t.lastmod)&&a.createElement("meta",{property:"article:modified_time",content:t.lastmod}),n&&a.createElement("meta",{property:"og:image",content:n}),n&&a.createElement("meta",{name:"twitter:image",content:n}))}},7304:function(e,t,n){n.d(t,{A:function(){return r}});

1var l=n(6540);function a({href:e,children:t,className:n,...a}){return l.createElement("a",Object.assign({href:e,target:"_blank",rel:"sponsored nofollow noopener",className:n},a),t)}function r(){const e="/veil-recommends/infosec-fundamentals";return l.createElement("aside",{className:"fc-wrap","aria-label":"Recommended course"},l.createElement("div",{className:"fc-header"},l.createElement("span",{className:"fc-dot fc-dot-r","aria-hidden":"true"}),l.createElement("span",{className:"fc-dot fc-dot-a","aria-hidden":"true"}),l.createElement("span",{className:"fc-dot fc-dot-g","aria-hidden":"true"}),l.createElement("span",{className:"fc-header-label"},"course_spotlight.sh")),l.createElement(a,{href:e,className:"fc-image-link","aria-label":"View Information Security Fundamentals course"},l.createElement("img",{src:"/img/hero/infosec-fundamentals.webp",alt:"Information Security Fundamentals course cover",className:"fc-image",loading:"lazy",width:"300",height:"169"})),l.createElement("div",{className:"fc-body"},l.createElement("div",{className:"fc-tag"},"Recommended Course"),l.createElement("h3",{className:"fc-title"},l.createElement(a,{href:e,className:"fc-title-link"},"Information Security Fundamentals")),l.createElement("p",{className:"fc-desc"},"Build a solid foundation in cybersecurity. Covers network fundamentals, common attack vectors, defensive controls, and the mindset needed for security research."),l.createElement("ul",{className:"fc-features"},l.createElement("li",{className:"fc-feature"},l.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Beginner-friendly — no prior experience needed"),l.createElement("li",{className:"fc-feature"},l.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Network attacks & defences"),l.createElement("li",{className:"fc-feature"},l.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Real-world security concepts")),l.createElement(a,{href:e,className:"fc-cta"},"View Course",l.createElement("span",{className:"fc-cta-arrow","aria-hidden":"true"}," →")),l.createElement("p",{className:"fc-disclosure"},"We may earn a commission if you enrol via our link, at no extra cost to you.")))}},8453:function(e,t,n){n.d(t,{RP:function(){return r}});

1var l=n(6540);const a=l.createContext({});function r(e){const t=l.useContext(a);return l.useMemo(()=>"function"==typeof e?e(t):{...t,...e},[t,e])}},8752:function(e,t,n){n.d(t,{A:function(){return a}});var l=n(6540);function a({sourceUrl:e}){const{0:t,1:n}=(0,l.useState)("idle"),{0:a,1:r}=(0,l.useState)("");return l.createElement("aside",{className:"nl-sw-wrap","aria-label":"Newsletter signup"},l.createElement("div",{className:"nl-sw-header"},l.createElement("span",{className:"nl-sw-dot nl-sw-dot-r","aria-hidden":"true"}),l.createElement("span",{className:"nl-sw-dot nl-sw-dot-a","aria-hidden":"true"}),l.createElement("span",{className:"nl-sw-dot nl-sw-dot-g","aria-hidden":"true"}),l.createElement("span",{className:"nl-sw-title"},"intel_feed.sh")),l.createElement("div",{className:"nl-sw-body"},l.createElement("p",{className:"nl-sw-prompt"},l.createElement("span",{className:"nl-sw-caret","aria-hidden":"true"},"$")," ","subscribe --to evasion-intel"),l.createElement("h3",{className:"nl-sw-heading"},"Stay ahead of the curve"),l.createElement("p",{className:"nl-sw-desc"},"AV bypass techniques, detection gaps, and lab-tested research — delivered before the mainstream catches up."),"done"===t?l.createElement("div",{className:"nl-sw-success",role:"status"},l.createElement("span",{className:"nl-sw-check","aria-hidden":"true"},"✓"),l.createElement("div",null,l.createElement("strong",null,"Subscribed."),l.createElement("br",null),l.createElement("span",{className:"nl-sw-success-sub"},"Confirm your email to activate."))):l.createElement("form",{onSubmit:async function(e){e.preventDefault();const t=e.currentTarget,l=new FormData(t);if(!l.get("company")){n("loading"),r("");try{const e=await fetch("/api/subscribe",{method:"POST",body:l}),a=await e.json();a.success?(n("done"),t.reset()):(n("err"),r(a.error||"Something went wrong."))}catch{n("err"),r("Network error — please try again.")}}},className:"nl-sw-form",noValidate:!0},l.createElement("input",{type:"hidden",name:"site",value:"veil-framework"}),l.createElement("input",{type:"hidden",name:"source_url",value:e||""}),l.createElement("input",{type:"text",name:"company",tabIndex:"-1","aria-hidden":"true",className:"nl-sw-hp",autoComplete:"off"}),l.createElement("label",{htmlFor:"nl-sw-name",className:"nl-sw-label"},"Your name"),l.createElement("input",{id:"nl-sw-name",type:"text",name:"name",placeholder:"alias or handle",required:!0,autoComplete:"given-name",className:"nl-sw-input",disabled:"loading"===t}),l.createElement("label",{htmlFor:"nl-sw-email",className:"nl-sw-label"},"Email address"),l.createElement("input",{id:"nl-sw-email",type:"email",name:"email",placeholder:"[email protected]",required:!0,autoComplete:"email",className:"nl-sw-input",disabled:"loading"===t}),"err"===t&&l.createElement("p",{className:"nl-sw-error",role:"alert"},a),l.createElement("button",{type:"submit",className:"nl-sw-btn",disabled:"loading"===t},"loading"===t?"Connecting…":"Subscribe to intel →"),l.createElement("p",{className:"nl-sw-legal"},"No spam. No vendor fluff. Unsubscribe any time."))))}},8963:function(e,t,n){n.d(t,{A:function(){return a}});

1var l=n(6540);function a({title:e,subtitle:t,primaryLink:n,primaryText:a,secondaryLink:r,secondaryText:c,backgroundImage:i}){const o=i?{backgroundImage:`linear-gradient(135deg, rgba(37, 99, 235, 0.85) 0%, rgba(13, 33, 55, 0.9) 100%), url(${i})`,backgroundSize:"cover",backgroundPosition:"center"}:{};return l.createElement("section",{className:"hero blueprint-section-subtle",style:o},l.createElement("div",{className:"container"},l.createElement("h1",null,e),t&&l.createElement("p",null,t),(n||r)&&l.createElement("div",{style:{display:"flex",gap:"var(--space-md)",flexWrap:"wrap"}},n&&l.createElement("a",{href:n,className:"btn btn-primary"},a||"Get Started"),r&&l.createElement("a",{href:r,className:"btn btn-outline"},c||"Learn More"))))}}}]);
2//# sourceMappingURL=component---src-components-page-template-jsx-content-file-path-content-posts-blue-team-monitoring-detecting-veil-framework-activity-in-logs-mdx-dc1d53651a2c1f181b05.js.map