Defensive Research
Zero Trust Microservices: East-West Detection
Zero trust microservices detection. Find east-west movement via new service-pair edges, workload identity drift, and Kafka abuse, with SPL and KQL analytics.
All writing
Archive
48 articles and counting.
Security Tools
Secrets Detection for Engineering Teams
Secrets detection that finds leaked credentials first. Git history, CI logs, and container layers, with pattern and entropy analytics plus a rotation-first runbook.
Detection Engineering
Credential Stuffing Detection
Credential stuffing detection that finds what hides under per-IP thresholds. Success-rate inversion, low-and-slow campaigns, and ATO signals in SPL and KQL.
Defensive Research
Supply Chain Attack Detection
Supply chain attack detection in CI/CD. Build-time egress, dependency drift, and artifact provenance, with Sigma and SPL analytics plus hermetic-build hardening.
Detection Engineering
Session Hijacking Detection
Session hijacking detection after MFA. Refresh-token reuse, device drift, and impossible travel, with SPL, KQL, and Sigma analytics plus a triage runbook.
Detection Engineering
YARA Rules for Incident Response
How to write YARA rules for incident response — durable signatures that survive a packer change, scanning files and memory, and tuning false positives.
Detection Engineering
Ransomware Early-Warning Detection
How to detect ransomware before mass encryption — shadow-copy deletion, mass file changes, and precursor signals, with a Sigma rule and recovery-focused hardening.
Detection Engineering
Detecting Lateral Movement
How to detect lateral movement — PsExec, WMI, and RDP signals in Windows telemetry, Sigma rules, and the segmentation and tiering that shrink the attacker's reach.
Detection Engineering
Detecting DCSync Attacks
How to detect DCSync — the Event 4662 replication signal, the GUIDs to watch, a Sigma rule, and the least-privilege hardening that removes the abused rights.
Detection Engineering
Detecting Process Injection
How to detect process injection — CreateRemoteThread, RWX memory, and process hollowing signals in Sysmon, a Sigma rule, and the tuning that keeps it high-fidelity.
Detection Engineering
Phishing Detection Beyond DMARC
How to detect phishing beyond DMARC — lookalike domains, display-name spoofing, newly-registered senders, and BEC signals, with an SPL analytic and layered defenses.
Detection Engineering
Building a Threat Hunting Hypothesis Library
How to build a threat-hunting hypothesis library — ATT&CK-driven hypotheses, the PEAK loop, a reusable template, and turning hunts into detections that stay.