Defensive Research
Zero Trust Microservices: East-West Detection
Zero trust microservices detection. Find east-west movement via new service-pair edges, workload identity drift, and Kafka abuse, with SPL and KQL analytics.
#detection-engineering
37 articles
Security Tools
Secrets Detection for Engineering Teams
Secrets detection that finds leaked credentials first. Git history, CI logs, and container layers, with pattern and entropy analytics plus a rotation-first runbook.
Detection Engineering
Credential Stuffing Detection
Credential stuffing detection that finds what hides under per-IP thresholds. Success-rate inversion, low-and-slow campaigns, and ATO signals in SPL and KQL.
Defensive Research
Supply Chain Attack Detection
Supply chain attack detection in CI/CD. Build-time egress, dependency drift, and artifact provenance, with Sigma and SPL analytics plus hermetic-build hardening.
Detection Engineering
Session Hijacking Detection
Session hijacking detection after MFA. Refresh-token reuse, device drift, and impossible travel, with SPL, KQL, and Sigma analytics plus a triage runbook.
Detection Engineering
YARA Rules for Incident Response
How to write YARA rules for incident response — durable signatures that survive a packer change, scanning files and memory, and tuning false positives.
Detection Engineering
Ransomware Early-Warning Detection
How to detect ransomware before mass encryption — shadow-copy deletion, mass file changes, and precursor signals, with a Sigma rule and recovery-focused hardening.
Detection Engineering
Detecting Lateral Movement
How to detect lateral movement — PsExec, WMI, and RDP signals in Windows telemetry, Sigma rules, and the segmentation and tiering that shrink the attacker's reach.
Detection Engineering
Detecting DCSync Attacks
How to detect DCSync — the Event 4662 replication signal, the GUIDs to watch, a Sigma rule, and the least-privilege hardening that removes the abused rights.
Detection Engineering
Detecting Process Injection
How to detect process injection — CreateRemoteThread, RWX memory, and process hollowing signals in Sysmon, a Sigma rule, and the tuning that keeps it high-fidelity.
Detection Engineering
Phishing Detection Beyond DMARC
How to detect phishing beyond DMARC — lookalike domains, display-name spoofing, newly-registered senders, and BEC signals, with an SPL analytic and layered defenses.
Detection Engineering
Building a Threat Hunting Hypothesis Library
How to build a threat-hunting hypothesis library — ATT&CK-driven hypotheses, the PEAK loop, a reusable template, and turning hunts into detections that stay.
Detection Engineering
C2 Beaconing Detection
How to detect C2 beaconing without ML — interval regularity, jitter analysis, and JA3 fingerprints over Zeek logs, with an SPL analytic and egress hardening.
Detection Engineering
Detecting BYOVD Attacks
How to detect BYOVD (bring-your-own-vulnerable-driver) attacks — the driver-load and service-creation signals, a Sigma rule, the LOLDrivers list, and HVCI hardening.
Detection Engineering
Detecting AD CS Abuse (ESC1–ESC8)
How to detect AD CS abuse — the ESC1 and ESC8 escalation paths, the CVE-2022-26923 case, certificate-request audit events, and the template hardening that stops it.
Detection Engineering
Detecting Living-off-the-Land Binaries
How to detect LOLBins without false positives — flag abuse of certutil, regsvr32, mshta and rundll32 by behavior, with a Sigma rule and allowlist tuning.
Detection Engineering
Sysmon Configuration for Threat Detection
A practical Sysmon configuration for threat detection — the event IDs that matter, a tuned config approach, what to send to your SIEM, and the rules it powers.
Detection Engineering
DNS Tunneling Detection
How to detect DNS tunneling without an ML model — query length, entropy, and frequency thresholds, a Suricata rule and a Zeek/SPL analytic, plus egress hardening.
Detection Engineering
Detecting NTLM Relay Attacks
How to detect and defend against NTLM relay — coercion primitives, the CVE-2025-24054 case, ADCS ESC8 audit events, and the SMB/LDAP signing plus EPA that stop it.
Detection Engineering
Detecting LSASS Credential Dumping
How to detect LSASS credential dumping — the Sysmon process-access signal, suspicious GrantedAccess masks, a Sigma rule, and the LSA protections that prevent it.
Detection Engineering
Kubernetes Security Events to Prioritize
The Kubernetes security events worth alerting on — exec into pods, privileged containers, host mounts, and RBAC changes — with Falco rules and audit-log detection.
Detection Engineering
CloudTrail Monitoring Patterns That Matter
The AWS CloudTrail monitoring patterns that actually catch attackers — root usage, IAM changes, logging tampering, and credential exfiltration, with detection logic.
Detection Engineering
MITRE ATT&CK Mapping Without Theater
MITRE ATT&CK mapping that drives decisions, not decoration — map to prioritize coverage, count only validated detections, and turn the matrix into a real backlog.
Detection Engineering
Sigma Rule Lifecycle: Hypothesis to Production
The Sigma rule lifecycle from hypothesis to production — status stages (experimental to stable), CI testing, tuning, versioning, and when to deprecate a rule.
Detection Engineering
Detection Engineering Workflow
A detection engineering workflow that ships — hypothesis to ATT&CK-mapped, data-validated, tested, version-controlled detections, gated by CI and measured.
Hardware Security
USB Rubber Ducky Detection Patterns
USB Rubber Ducky detection patterns for blue teams — spotting HID injection with Sigma, USB device control and AppLocker hardening, and MITRE ATT&CK mapping.
Detection Engineering
OAuth Misconfiguration: Defensive Review
An OAuth misconfiguration defensive review — redirect_uri validation, PKCE and state, detecting off-allowlist redirects and token anomalies, aligned to RFC 9700.
Detection Engineering
GraphQL Authorization Mistakes to Detect
Detect GraphQL authorization mistakes — BOLA argument manipulation, introspection exposure, and query-level-only checks, with Sigma rules and hardening.
Detection Engineering
File Upload Security: A Blue Team Checklist
File upload security for blue teams — detect web-shell uploads with FIM and process telemetry, Sigma and YARA rules, plus a hardening checklist.
Defensive Research
Linux Privilege Escalation: Defensive Lessons
Linux privilege escalation detection for defenders — auditd rules for sudo, SUID and GTFOBins abuse, a CVE-2025-32463 sudo chroot case study, and hardening.
Detection Engineering
Command Injection Logs: What to Watch
Command injection detection from logs — the telemetry that exposes OS command injection, Sigma and Suricata rules, a CVE-2024-3400 case study, and hardening.
Defensive Research
Broken Access Control Testing for Defenders
Broken access control testing for defenders — detect IDOR and BOLA from authorization-failure telemetry with Sigma and SPL rules, plus deny-by-default hardening.
Detection Engineering
JWT Misconfiguration: Detection and Defense
JWT misconfiguration detection and defense — alg:none, RS256-to-HS256 confusion, and kid injection, with header-logging detection, Sigma rules, and MITRE mapping.
Detection Engineering
SSRF Detection Without Exploit Code
SSRF detection without running exploits — metadata-access signatures, Sigma/Suricata/CloudTrail rules, IMDSv2 defense, a CVE-2025-53767 case, and tuning tips.
Detection Engineering
XSS CSP Hardening for Blue Teams
XSS CSP hardening for blue teams — a strict nonce-based policy, CSP violation reports as a detection feed, Sigma and Suricata rules, tuning, and MITRE mapping.
Detection Engineering
SQL Injection Detection: A Defensive Guide
How to detect SQL injection across web, app, and database telemetry — with Sigma, Suricata, and SPL rules, a CVE-2025-1094 case study, and tuning tips. Lab-only.
Detection Engineering
Writing Sigma Rules That Actually Fire (Not Just Compile)
A detection engineer's guide to Sigma rules that survive production — pinned logsources, behavioral logic, field-mapping pipelines, tuned false positives, and CI.