Click any image to see it full size. Press Esc or click again to close it.

The quickest way: paste a screenshot

1. Take a screenshot with Win + Shift + S.
2. Click where you want it in your post and press Ctrl + V.

VS Code saves the image into this post’s folder and inserts a line like this:

![Alt text](../assets/img/my-post/image.png)

Change Alt text to a short description of what the image shows, and rename the file to something meaningful (image.png → edr-alert.png). You can also drag image files from File Explorer into the post; they’re copied into the same folder.

A plain image

The simplest form, for an image that needs no caption:

![Process tree showing Word launching PowerShell](/assets/img/example-post-with-images-and-gifs/process-tree.png)

An image with a caption

Type fig and press Ctrl + Space to insert this. Captions can include code and bold.

{% include figure.html src="/assets/img/example-post-with-images-and-gifs/siem-alerts.png" alt="SIEM alert list showing Kerberoasting alerts on DC01" caption="The first two alerts fired within two seconds of each other on `DC01`." %}

A wide image

For dashboards and wide screenshots, add wide=true (shortcut: figwide). On a computer the image spreads wider than the text; on a phone it fits the screen as normal.

{% include figure.html src="/assets/img/example-post-with-images-and-gifs/siem-alerts.png" alt="…" caption="…" wide=true %}

Two images side by side

Good for before-and-after comparisons (shortcut: figpair). On phones they stack one above the other.

{% include figure.html src="/assets/img/example-post-with-images-and-gifs/sshd-before.png" alt="sshd_config before hardening" src2="/assets/img/example-post-with-images-and-gifs/sshd-after.png" alt2="sshd_config after hardening" caption="Four settings changed in `sshd_config`." %}

A GIF

GIFs work exactly like images: use either form above and point it at the .gif file (shortcut: gif).

{% include figure.html src="/assets/img/example-post-with-images-and-gifs/nmap-scan.gif" alt="Terminal running an Nmap service scan" caption="A service scan against the test host." %}

A screen recording (better than a GIF)

The same animation saved as an MP4 video is a third of the size, and the gap grows with longer or more colourful clips. It plays exactly like a GIF: silent, looping, and starting by itself (shortcut: video).

{% include video.html src="/assets/img/example-post-with-images-and-gifs/nmap-scan.mp4" alt="Terminal running an Nmap service scan" caption="The same scan as a video." %}

For longer recordings that readers might want to pause, add controls=true. The clip then waits for the reader to press play and shows a timeline.

Tip

To turn a GIF into an MP4, install ffmpeg once with winget install Gyan.FFmpeg, then run:

ffmpeg -i clip.gif -movflags +faststart -pix_fmt yuv420p -vf "scale=trunc(iw/2)*2:trunc(ih/2)*2" clip.mp4

Windows’ built-in Snipping Tool can also record your screen straight to MP4: press Win + Shift + R.

Keeping images light

The free hosting plan holds 250 MB for the whole site, and large images also slow pages down. A few habits keep both in check:

Crop screenshots to the part that matters before pasting, and keep them no wider than about 2,000 pixels. Before publishing, check every image for anything sensitive: hostnames, usernames, tokens, IP ranges. Cover them with solid boxes rather than blur.

Text basics

Write paragraphs as normal. Use bold for emphasis, italics for terms, and inline code for commands, file paths like C:\Windows\System32\drivers\etc\hosts, or registry keys. Keyboard shortcuts look like Ctrl + Shift + V.

Links work the usual way: MITRE ATT&CK T1059.001.

Callouts

Use GitHub-style alerts. They render as callouts on the site, and GitHub shows them properly too.

Note

Background context the reader might want, but can skip.

Tip

A faster way to do something.

Important

Something the reader must know to succeed.

Warning

This command modifies production firewall rules. Test in a lab first.

Caution

Live malware sample. Handle only inside an isolated analysis VM.

Code blocks

Put the language after the opening backticks to get highlighting, a label and a copy button.

# Hunt for recently modified SUID binaries
find / -perm -4000 -type f -mtime -7 2>/dev/null | xargs ls -la

# Pull failed logons from the last 24 hours
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} |
  Select-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}}, @{n='Source';e={$_.Properties[19].Value}}

import hashlib
from pathlib import Path

def sha256(path: Path) -> str:
    h = hashlib.sha256()
    with path.open("rb") as f:
        for chunk in iter(lambda: f.read(65536), b""):
            h.update(chunk)
    return h.hexdigest()

title: Suspicious Encoded PowerShell Command
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains: ' -enc '
  condition: selection
level: high

- AllowTcpForwarding yes
+ AllowTcpForwarding no

Tables

Good for indicators of compromise and CVE round-ups.

Lists

1. Contain the host.
2. Capture memory before rebooting.
3. Pull the relevant logs.

Bullet points work too:

• Start each line with a dash
• Nest them by indenting two spaces
  • like this

Images

Each post keeps its pictures in its own folder, assets/img/<post-name>/. The quickest way to add one is to take a screenshot (Win + Shift + S), click into the post and press Ctrl + V: VS Code saves the file into that folder and inserts the link. Then replace “Alt text” with a short description of the picture.

![Process tree from the EDR console](/assets/img/my-post/process-tree.png)

For captions, extra-wide screenshots, before-and-after pairs, GIFs and screen recordings, see Example post: images, GIFs and screen recordings.

Preview images

Add an image: line to the front matter and that picture appears next to the post on the home page and its category page. It’s also the card image when someone shares the link on LinkedIn, X, Slack or Teams.

image: /assets/img/my-post/cover.png

Landscape images around 1200 × 630 pixels work best for both; keep anything important away from the edges, as they may be trimmed slightly. Posts without an image get a tile showing their first tag, and shares use the site’s default card.