EDR / Credential Access · 14 min read
Most LSASS-dumping detections start and end with "alert on
access to lsass.exe," which either misses tools that avoid the
obvious flags or buries the SOC in self-noise from AV and
backup agents. Here's how to use the Sysmon
GrantedAccess mask, source-image allowlisting, and
the comsvcs.dll MiniDump technique to build something that
survives contact with a real environment.
Read full post →
SOC Workflow · 11 min read
Tuning usually happens after the false positives pile up and
someone on shift finally complains. Treating precision as a
designed-in property of a detection — with a stated
target, an owner, and a review cadence — changes how a
SOC triages day to day, and turns tuning into scheduled work
instead of emergency response.
Read full post →
Process · 12 min read
Most maturity models measure activity instead of outcomes:
rule counts, ATT&CK heatmaps, dashboards nobody acts on. A
model built around three facts per detection — technique
mapping, measured false-positive rate, and a named owner
— is boring enough that teams actually keep filling it
in.
Read full post →
Threat Hunting · 13 min read
A hunt is only worth the time it took if it turns into
something repeatable. This one started as a manual sweep for
suspicious scheduled tasks and ended as a standing detection
once the underlying pattern held up across three separate
incidents — here's the walkthrough from hypothesis to
shipped rule.
Read full post →
Sigma / EDR · 15 min read
Living-off-the-land binaries are useful to attackers precisely
because they're useful to admins. A detection that fires on
rundll32.exe execution alone will bury a SOC in
false positives within a day. The fix is scoping on process
lineage, command-line entropy, and signature checks instead of
a smarter binary list.
Read full post →
Sigma / SIEM · 12 min read
Sigma's pitch is "write once, run anywhere," and the backend
converters mostly deliver — right up until a field
mapping silently drops a condition instead of erroring out. A
look at the failure modes that don't fail loudly, and how to
catch them in CI before they cost you coverage.
Read full post →