Knowing which event IDs to watch is half the job; getting them off every endpoint before the local Security log wraps is the other h...
Microsoft Defender's Advanced Hunting is genuinely useful — possibly the most useful thing in the portal that does not have a f...
A few weeks ago we tried to improve our phishing simulation game for new employees in Microsoft 365 . The goal was simple: new hire...
Going from MITRE ATT&CK to SIEM rules is the part of detection engineering nobody enjoys. You read about a technique, decide yo...
SIEM correlation rules are what turn a pile of Windows events into actual detections. Single-event rules ("alert on Event 4625...
YARA rules are the closest thing defenders have to a structured language for describing malware. Antivirus signatures match exact b...
