Detection
How to turn threat intel into detections with Sigma, YARA and KQL; the pyramid of pain, telemetry you need, and where to get vetted rules.
Detection
Detection logic for the core AD attacks: Kerberoasting (4769 RC4), DCSync (4662 replication), NTLM relay/coercion, and AD CS abuse.
Detection
Detection logic for identity-first attacks: AiTM/token replay, OAuth consent grants, and cloud IAM abuse (IMDS, role changes, S3 SSE-C).
Detection
Detection logic for the ransomware kill chain: living-off-the-land, BYOVD/EDR-kill, ESXi lockers and macOS stealer activity.
Detection
Detection logic for edge-device intrusions: web shells on VPNs/firewalls, config tampering, and lateral-movement artifacts (ADMIN$, Chisel).