Detection Engineering
Credential Stuffing Detection
Credential stuffing detection that finds what hides under per-IP thresholds. Success-rate inversion, low-and-slow campaigns, and ATO signals in SPL and KQL.
Topic hub
Detection Engineering
Writing, tuning, and testing detections: Sigma rules, YARA signatures, Suricata/Snort, threat hunting, and the telemetry pipeline that turns an attack into an alert before it becomes an incident.
31 articles
API Security
Detection Engineering
OAuth Misconfiguration: Defensive Review
An OAuth misconfiguration defensive review — redirect_uri validation, PKCE and state, detecting off-allowlist redirects and token anomalies, aligned to RFC 9700.
Detection Engineering
GraphQL Authorization Mistakes to Detect
Detect GraphQL authorization mistakes — BOLA argument manipulation, introspection exposure, and query-level-only checks, with Sigma rules and hardening.
Identity Threat Detection
Detection Engineering
Session Hijacking Detection
Session hijacking detection after MFA. Refresh-token reuse, device drift, and impossible travel, with SPL, KQL, and Sigma analytics plus a triage runbook.
Incident Response
Detection Engineering
YARA Rules for Incident Response
How to write YARA rules for incident response — durable signatures that survive a packer change, scanning files and memory, and tuning false positives.
Ransomware Defense
Detection Engineering
Ransomware Early-Warning Detection
How to detect ransomware before mass encryption — shadow-copy deletion, mass file changes, and precursor signals, with a Sigma rule and recovery-focused hardening.
Windows Threat Detection
Detection Engineering
Detecting Lateral Movement
How to detect lateral movement — PsExec, WMI, and RDP signals in Windows telemetry, Sigma rules, and the segmentation and tiering that shrink the attacker's reach.
Detection Engineering
Detecting Process Injection
How to detect process injection — CreateRemoteThread, RWX memory, and process hollowing signals in Sysmon, a Sigma rule, and the tuning that keeps it high-fidelity.
Detection Engineering
Detecting BYOVD Attacks
How to detect BYOVD (bring-your-own-vulnerable-driver) attacks — the driver-load and service-creation signals, a Sigma rule, the LOLDrivers list, and HVCI hardening.
Detection Engineering
Detecting Living-off-the-Land Binaries
How to detect LOLBins without false positives — flag abuse of certutil, regsvr32, mshta and rundll32 by behavior, with a Sigma rule and allowlist tuning.
Detection Engineering
Sysmon Configuration for Threat Detection
A practical Sysmon configuration for threat detection — the event IDs that matter, a tuned config approach, what to send to your SIEM, and the rules it powers.
Detection Engineering
Detecting LSASS Credential Dumping
How to detect LSASS credential dumping — the Sysmon process-access signal, suspicious GrantedAccess masks, a Sigma rule, and the LSA protections that prevent it.
Active Directory Attacks
Detection Engineering
Detecting DCSync Attacks
How to detect DCSync — the Event 4662 replication signal, the GUIDs to watch, a Sigma rule, and the least-privilege hardening that removes the abused rights.
Detection Engineering
Detecting AD CS Abuse (ESC1–ESC8)
How to detect AD CS abuse — the ESC1 and ESC8 escalation paths, the CVE-2022-26923 case, certificate-request audit events, and the template hardening that stops it.
Detection Engineering
Detecting NTLM Relay Attacks
How to detect and defend against NTLM relay — coercion primitives, the CVE-2025-24054 case, ADCS ESC8 audit events, and the SMB/LDAP signing plus EPA that stop it.
Email Security
Detection Engineering
Phishing Detection Beyond DMARC
How to detect phishing beyond DMARC — lookalike domains, display-name spoofing, newly-registered senders, and BEC signals, with an SPL analytic and layered defenses.
Threat Hunting
Detection Engineering
Building a Threat Hunting Hypothesis Library
How to build a threat-hunting hypothesis library — ATT&CK-driven hypotheses, the PEAK loop, a reusable template, and turning hunts into detections that stay.
Network Threat Detection
Detection Engineering
C2 Beaconing Detection
How to detect C2 beaconing without ML — interval regularity, jitter analysis, and JA3 fingerprints over Zeek logs, with an SPL analytic and egress hardening.
Detection Engineering
DNS Tunneling Detection
How to detect DNS tunneling without an ML model — query length, entropy, and frequency thresholds, a Suricata rule and a Zeek/SPL analytic, plus egress hardening.
Cloud Security
Detection Engineering
Kubernetes Security Events to Prioritize
The Kubernetes security events worth alerting on — exec into pods, privileged containers, host mounts, and RBAC changes — with Falco rules and audit-log detection.
Detection Engineering
CloudTrail Monitoring Patterns That Matter
The AWS CloudTrail monitoring patterns that actually catch attackers — root usage, IAM changes, logging tampering, and credential exfiltration, with detection logic.
Detection as Code
Detection Engineering
MITRE ATT&CK Mapping Without Theater
MITRE ATT&CK mapping that drives decisions, not decoration — map to prioritize coverage, count only validated detections, and turn the matrix into a real backlog.
Detection Engineering
Sigma Rule Lifecycle: Hypothesis to Production
The Sigma rule lifecycle from hypothesis to production — status stages (experimental to stable), CI testing, tuning, versioning, and when to deprecate a rule.
Detection Engineering
Detection Engineering Workflow
A detection engineering workflow that ships — hypothesis to ATT&CK-mapped, data-validated, tested, version-controlled detections, gated by CI and measured.
Detection Engineering
Writing Sigma Rules That Actually Fire (Not Just Compile)
A detection engineer's guide to Sigma rules that survive production — pinned logsources, behavioral logic, field-mapping pipelines, tuned false positives, and CI.
Web Application Defense
Detection Engineering
File Upload Security: A Blue Team Checklist
File upload security for blue teams — detect web-shell uploads with FIM and process telemetry, Sigma and YARA rules, plus a hardening checklist.
Detection Engineering
Command Injection Logs: What to Watch
Command injection detection from logs — the telemetry that exposes OS command injection, Sigma and Suricata rules, a CVE-2024-3400 case study, and hardening.
Detection Engineering
JWT Misconfiguration: Detection and Defense
JWT misconfiguration detection and defense — alg:none, RS256-to-HS256 confusion, and kid injection, with header-logging detection, Sigma rules, and MITRE mapping.
Detection Engineering
SSRF Detection Without Exploit Code
SSRF detection without running exploits — metadata-access signatures, Sigma/Suricata/CloudTrail rules, IMDSv2 defense, a CVE-2025-53767 case, and tuning tips.
Detection Engineering
XSS CSP Hardening for Blue Teams
XSS CSP hardening for blue teams — a strict nonce-based policy, CSP violation reports as a detection feed, Sigma and Suricata rules, tuning, and MITRE mapping.
Detection Engineering
SQL Injection Detection: A Defensive Guide
How to detect SQL injection across web, app, and database telemetry — with Sigma, Suricata, and SPL rules, a CVE-2025-1094 case study, and tuning tips. Lab-only.