// articles

Detection write-ups

Case notes, rule logic, and lessons learned from the SOC floor.

EDR / Credential Access · 14 min read

Detecting credential dumping via LSASS access patterns

Most LSASS-dumping detections start and end with "alert on access to lsass.exe," which either misses tools that avoid the obvious flags or buries the SOC in self-noise from AV and backup agents. Here's how to use the Sysmon GrantedAccess mask, source-image allowlisting, and the comsvcs.dll MiniDump technique to build something that survives contact with a real environment.

Read full post →
SOC Workflow · 11 min read

Alert fatigue is a detection engineering problem

Tuning usually happens after the false positives pile up and someone on shift finally complains. Treating precision as a designed-in property of a detection — with a stated target, an owner, and a review cadence — changes how a SOC triages day to day, and turns tuning into scheduled work instead of emergency response.

Read full post →
Threat Hunting · 13 min read

Hunting for living-off-the-land persistence

A hunt is only worth the time it took if it turns into something repeatable. This one started as a manual sweep for suspicious scheduled tasks and ended as a standing detection once the underlying pattern held up across three separate incidents — here's the walkthrough from hypothesis to shipped rule.

Read full post →
Sigma / EDR · 15 min read

Writing detections for LOLBins without drowning in noise

Living-off-the-land binaries are useful to attackers precisely because they're useful to admins. A detection that fires on rundll32.exe execution alone will bury a SOC in false positives within a day. The fix is scoping on process lineage, command-line entropy, and signature checks instead of a smarter binary list.

Read full post →