Defensive Research
Zero Trust Microservices: East-West Detection
Zero trust microservices detection. Find east-west movement via new service-pair edges, workload identity drift, and Kafka abuse, with SPL and KQL analytics.
Colson
Articles by Colson
Security Tools
Secrets Detection for Engineering Teams
Secrets detection that finds leaked credentials first. Git history, CI logs, and container layers, with pattern and entropy analytics plus a rotation-first runbook.
Detection Engineering
Credential Stuffing Detection
Credential stuffing detection that finds what hides under per-IP thresholds. Success-rate inversion, low-and-slow campaigns, and ATO signals in SPL and KQL.
Defensive Research
Supply Chain Attack Detection
Supply chain attack detection in CI/CD. Build-time egress, dependency drift, and artifact provenance, with Sigma and SPL analytics plus hermetic-build hardening.
Detection Engineering
Session Hijacking Detection
Session hijacking detection after MFA. Refresh-token reuse, device drift, and impossible travel, with SPL, KQL, and Sigma analytics plus a triage runbook.
Detection Engineering
YARA Rules for Incident Response
How to write YARA rules for incident response — durable signatures that survive a packer change, scanning files and memory, and tuning false positives.
Detection Engineering
Ransomware Early-Warning Detection
How to detect ransomware before mass encryption — shadow-copy deletion, mass file changes, and precursor signals, with a Sigma rule and recovery-focused hardening.
Detection Engineering
Detecting Lateral Movement
How to detect lateral movement — PsExec, WMI, and RDP signals in Windows telemetry, Sigma rules, and the segmentation and tiering that shrink the attacker's reach.
Detection Engineering
Detecting DCSync Attacks
How to detect DCSync — the Event 4662 replication signal, the GUIDs to watch, a Sigma rule, and the least-privilege hardening that removes the abused rights.
Detection Engineering
Detecting Process Injection
How to detect process injection — CreateRemoteThread, RWX memory, and process hollowing signals in Sysmon, a Sigma rule, and the tuning that keeps it high-fidelity.
Detection Engineering
Phishing Detection Beyond DMARC
How to detect phishing beyond DMARC — lookalike domains, display-name spoofing, newly-registered senders, and BEC signals, with an SPL analytic and layered defenses.
Detection Engineering
Building a Threat Hunting Hypothesis Library
How to build a threat-hunting hypothesis library — ATT&CK-driven hypotheses, the PEAK loop, a reusable template, and turning hunts into detections that stay.
Detection Engineering
C2 Beaconing Detection
How to detect C2 beaconing without ML — interval regularity, jitter analysis, and JA3 fingerprints over Zeek logs, with an SPL analytic and egress hardening.
Detection Engineering
Detecting BYOVD Attacks
How to detect BYOVD (bring-your-own-vulnerable-driver) attacks — the driver-load and service-creation signals, a Sigma rule, the LOLDrivers list, and HVCI hardening.
Detection Engineering
Detecting AD CS Abuse (ESC1–ESC8)
How to detect AD CS abuse — the ESC1 and ESC8 escalation paths, the CVE-2022-26923 case, certificate-request audit events, and the template hardening that stops it.
Detection Engineering
Detecting Living-off-the-Land Binaries
How to detect LOLBins without false positives — flag abuse of certutil, regsvr32, mshta and rundll32 by behavior, with a Sigma rule and allowlist tuning.
Detection Engineering
Sysmon Configuration for Threat Detection
A practical Sysmon configuration for threat detection — the event IDs that matter, a tuned config approach, what to send to your SIEM, and the rules it powers.
Detection Engineering
DNS Tunneling Detection
How to detect DNS tunneling without an ML model — query length, entropy, and frequency thresholds, a Suricata rule and a Zeek/SPL analytic, plus egress hardening.
Detection Engineering
Detecting NTLM Relay Attacks
How to detect and defend against NTLM relay — coercion primitives, the CVE-2025-24054 case, ADCS ESC8 audit events, and the SMB/LDAP signing plus EPA that stop it.
Detection Engineering
Detecting LSASS Credential Dumping
How to detect LSASS credential dumping — the Sysmon process-access signal, suspicious GrantedAccess masks, a Sigma rule, and the LSA protections that prevent it.
Security Tools
Best Password Managers for Security Teams
The best password managers for security teams — how to evaluate SSO, SCIM, passkeys, and recovery, with 1Password and Bitwarden compared.
Security Tools
TryHackMe vs HackTheBox for Security Training
TryHackMe vs HackTheBox for security training — how they differ on blue-team/SOC content, learning style, pricing, and business plans, and which to choose when.
Detection Engineering
Kubernetes Security Events to Prioritize
The Kubernetes security events worth alerting on — exec into pods, privileged containers, host mounts, and RBAC changes — with Falco rules and audit-log detection.
Detection Engineering
CloudTrail Monitoring Patterns That Matter
The AWS CloudTrail monitoring patterns that actually catch attackers — root usage, IAM changes, logging tampering, and credential exfiltration, with detection logic.
Detection Engineering
MITRE ATT&CK Mapping Without Theater
MITRE ATT&CK mapping that drives decisions, not decoration — map to prioritize coverage, count only validated detections, and turn the matrix into a real backlog.
Detection Engineering
Sigma Rule Lifecycle: Hypothesis to Production
The Sigma rule lifecycle from hypothesis to production — status stages (experimental to stable), CI testing, tuning, versioning, and when to deprecate a rule.
Detection Engineering
Detection Engineering Workflow
A detection engineering workflow that ships — hypothesis to ATT&CK-mapped, data-validated, tested, version-controlled detections, gated by CI and measured.
Security Tools
YubiKey Deployment: A Practical Security Guide
A practical YubiKey deployment guide — phased FIDO2 rollout, closing phishable MFA fallbacks, detecting downgrade attacks, aligned to CISA and NIST SP 800-63-4.
Hardware Security
BadUSB Controls for Engineering Teams
BadUSB controls that survive contact with engineering teams — USB device control, HID allowlisting, USBGuard and WDAC, plus detection that does not block real work.
Hardware Security
Evil Twin Access Points: Defensive Controls
Evil twin access point defenses for blue teams — detect rogue APs with a WIDS, why 802.1X server-cert validation and WPA3 matter, plus a captive-portal DNS signal.
Hardware Security
WiFi Deauthentication Detection Guide
A WiFi deauthentication detection guide — spot deauth floods with a WIDS, why 802.11w PMF and WPA3 help (and where they fall short, CVE-2023-21061), plus hardening.
Hardware Security
USB Rubber Ducky Detection Patterns
USB Rubber Ducky detection patterns for blue teams — spotting HID injection with Sigma, USB device control and AppLocker hardening, and MITRE ATT&CK mapping.
Hardware Security
Proxmark3 RFID Security for Defenders
A defender's guide to Proxmark3 RFID security — auditing 125 kHz and MIFARE Classic credentials, detecting cloned badges, and migrating to DESFire EV3 and AES.
Hardware Security
Flipper Zero NFC Risk: What Teams Should Know
The real Flipper Zero NFC risk for security teams — what it can and cannot clone, MIFARE Classic weaknesses, access-control detection, and credential hardening.
Hardware Security
HackRF One for Defensive RF Awareness
How blue teams use HackRF One for defensive RF awareness — spectrum baselining, rogue-transmitter detection, a WIDS monitoring approach, and RF hardening.
Detection Engineering
OAuth Misconfiguration: Defensive Review
An OAuth misconfiguration defensive review — redirect_uri validation, PKCE and state, detecting off-allowlist redirects and token anomalies, aligned to RFC 9700.
Detection Engineering
GraphQL Authorization Mistakes to Detect
Detect GraphQL authorization mistakes — BOLA argument manipulation, introspection exposure, and query-level-only checks, with Sigma rules and hardening.
Detection Engineering
File Upload Security: A Blue Team Checklist
File upload security for blue teams — detect web-shell uploads with FIM and process telemetry, Sigma and YARA rules, plus a hardening checklist.
Defensive Research
Linux Privilege Escalation: Defensive Lessons
Linux privilege escalation detection for defenders — auditd rules for sudo, SUID and GTFOBins abuse, a CVE-2025-32463 sudo chroot case study, and hardening.
Detection Engineering
Command Injection Logs: What to Watch
Command injection detection from logs — the telemetry that exposes OS command injection, Sigma and Suricata rules, a CVE-2024-3400 case study, and hardening.
Defensive Research
Broken Access Control Testing for Defenders
Broken access control testing for defenders — detect IDOR and BOLA from authorization-failure telemetry with Sigma and SPL rules, plus deny-by-default hardening.
Detection Engineering
JWT Misconfiguration: Detection and Defense
JWT misconfiguration detection and defense — alg:none, RS256-to-HS256 confusion, and kid injection, with header-logging detection, Sigma rules, and MITRE mapping.
Detection Engineering
SSRF Detection Without Exploit Code
SSRF detection without running exploits — metadata-access signatures, Sigma/Suricata/CloudTrail rules, IMDSv2 defense, a CVE-2025-53767 case, and tuning tips.
Detection Engineering
XSS CSP Hardening for Blue Teams
XSS CSP hardening for blue teams — a strict nonce-based policy, CSP violation reports as a detection feed, Sigma and Suricata rules, tuning, and MITRE mapping.
Detection Engineering
SQL Injection Detection: A Defensive Guide
How to detect SQL injection across web, app, and database telemetry — with Sigma, Suricata, and SPL rules, a CVE-2025-1094 case study, and tuning tips. Lab-only.
Detection Engineering
Writing Sigma Rules That Actually Fire (Not Just Compile)
A detection engineer's guide to Sigma rules that survive production — pinned logsources, behavioral logic, field-mapping pipelines, tuned false positives, and CI.
Hardware Security
Detecting WPA2 PMKID Capture in Your Wireless Estate
How the clientless PMKID attack pulls a crackable hash from WPA2 APs — and the monitoring, WPA3 migration, and passphrase policy that defend against it.
Defensive Research
Anatomy of a Kerberoasting Attack — and How to Detect It
How Kerberoasting abuses service tickets to crack service-account passwords offline — and the Sigma detection and hardening that shut it down. Lab-only.