Detection Engineering
Ransomware Early-Warning Detection
How to detect ransomware before mass encryption — shadow-copy deletion, mass file changes, and precursor signals, with a Sigma rule and recovery-focused hardening.
#windows
9 articles
Detection Engineering
Detecting Lateral Movement
How to detect lateral movement — PsExec, WMI, and RDP signals in Windows telemetry, Sigma rules, and the segmentation and tiering that shrink the attacker's reach.
Detection Engineering
Detecting Process Injection
How to detect process injection — CreateRemoteThread, RWX memory, and process hollowing signals in Sysmon, a Sigma rule, and the tuning that keeps it high-fidelity.
Detection Engineering
Detecting BYOVD Attacks
How to detect BYOVD (bring-your-own-vulnerable-driver) attacks — the driver-load and service-creation signals, a Sigma rule, the LOLDrivers list, and HVCI hardening.
Detection Engineering
Detecting AD CS Abuse (ESC1–ESC8)
How to detect AD CS abuse — the ESC1 and ESC8 escalation paths, the CVE-2022-26923 case, certificate-request audit events, and the template hardening that stops it.
Detection Engineering
Detecting Living-off-the-Land Binaries
How to detect LOLBins without false positives — flag abuse of certutil, regsvr32, mshta and rundll32 by behavior, with a Sigma rule and allowlist tuning.
Detection Engineering
Sysmon Configuration for Threat Detection
A practical Sysmon configuration for threat detection — the event IDs that matter, a tuned config approach, what to send to your SIEM, and the rules it powers.
Detection Engineering
Detecting NTLM Relay Attacks
How to detect and defend against NTLM relay — coercion primitives, the CVE-2025-24054 case, ADCS ESC8 audit events, and the SMB/LDAP signing plus EPA that stop it.
Detection Engineering
Detecting LSASS Credential Dumping
How to detect LSASS credential dumping — the Sysmon process-access signal, suspicious GrantedAccess masks, a Sigma rule, and the LSA protections that prevent it.