Every custom Sigma pipeline exists to solve the same problem: a Sigma rule speaks an abstract field taxonomy, and your SIEM does no...
Writing Custom Sigma Pipelines for Your Log Schema
Showing posts with label Detection Engineering. Show all posts
Showing posts with label Detection Engineering. Show all posts
Sigma Rule for LSASS Credential Access (Event ID 10)
A Sigma rule for LSASS credential access targets the single most valuable move in a Windows intrusion: a process opening lsass.exe ...
MITRE ATT&CK in Python: From STIX Data to Coverage Map
Working with MITRE ATT&CK in Python beats clicking through the matrix the moment you want real answers out of the framework — whic...
Python for Threat Hunting: IOCs, Hashing, Integrity
Python for threat hunting shines at the unglamorous middle of an investigation: turning a wall of raw text into indicators, check...
KQL Threat Hunting in Microsoft Defender: Full Guide
Most KQL tutorials hand you a pile of operators and leave you to work out how they fit together. This guide does the opposite. It wa...
Subscribe to:
Posts (Atom)