# Tracks and Traces

Tracks and Traces is a Substack about my journey building tools for adversary emulation and detection engineering. I'm sharing what I learn about creating tools that emulate adversary tracks and trace the artifacts they produce.

Page: <https://rssamplifier.com/cyberbuff-substack-com>  
Feed: <https://rssamplifier.com/cyberbuff-substack-com.md>

---

## [Introducing Living off the Orchard: Apple Script](https://cyberbuff.substack.com/p/introducing-living-off-the-orchard)

_2025-11-27 · cyberbuff_

When Built-In Features Become Security Risks: Testing AppleScript and JXA Abuse

## [Atomic Red Team MCP #2 - Claude becomes C2](https://cyberbuff.substack.com/p/atomic-red-team-mcp-2-claude-becomes)

_2025-11-04 · cyberbuff_

Breaking Everything, Everywhere, All at Once

## [Atomic Red Team MCP #1 - Claude becomes the APT](https://cyberbuff.substack.com/p/claude-becomes-the-apt)

_2025-10-31 · cyberbuff_

Breaking Things with Atomic Red Team MCP because manual exploitation is so last decade