#detection-engineering articles

KDKajal Dhanjalkajalbuilds.hashnode.devJun 30 · 4 min read

Building a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just Attackers

Repo: github.com/Kajal-Dhanjal/sentinel-detection-lab Most process-lineage detections in SOC content are written to catch attackers—Office spawning PowerShell, a browser spawning cmd.exe. Part 8 is th

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 21 · 9 min read

Building a Sentinel Detection Lab, Part 5: MFA Registration, a Missing License, and the First Detection That Talks Back

https://github.com/Kajal-Dhanjal/sentinel-detection-lab Part 4 ended on this note: moving off the endpoint entirely and into identity, starting with attackers registering their own MFA methods on com

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 21 · 6 min read

Building a Sentinel Detection Lab, Part 4: Catching Reconnaissance — and the Case-Sensitivity Bug That Made It Look Broken

https://github.com/Kajal-Dhanjal/sentinel-detection-lab This is Part 4 of the series where I build a Microsoft Sentinel detection engineering lab from scratch and write down what actually happened —

0

KDKajal Dhanjalkajalbuilds.hashnode.devJun 15 · 4 min read

Building a Sentinel Detection Lab, Part 3: My Detection Flagged Legitimate Windows Behavior — Here's How I Tuned It Without Going Blind

Part 3 of a series on building a detection engineering lab in Microsoft Sentinel. This post: registry persistence, a textbook false positive, and the single most important lesson in detection engineer

1

K

KDKajal Dhanjalkajalbuilds.hashnode.devJun 15 · 4 min read

Building a Sentinel Detection Lab, Part 2: Suspicious PowerShell, and Why Some Detections Need No Threshold

Part 2 of a series on building a detection engineering lab in Microsoft Sentinel. This post: hunting malicious PowerShell with Sysmon, and the difference between volume detections and signature detect

0

AVAnvesh Vishwarajuanveshtheaisocanalyst.hashnode.devMay 22 · 4 min read

Bridging the Detection-Exploitation Gap with AI: Building PentestX

Background In most security operations centres, offensive and defensive knowledge exist in separate silos. Penetration testers understand exploitation chains intimately. SOC analysts understand alert

0

RTRicky Tiplerrickytipler.hashnode.devMay 15 · 6 min read

Active Directory Certificate Services Abuse: The Hidden Path to Domain Compromise

Why This Matters Most defenders hunt for credential theft, Kerberoasting, or suspicious PowerShell. But what if an attacker never steals a password at all? In many Active Directory environments, misco

0

PHPrayush Hadaprayush.hashnode.devMay 2 · 7 min read

From Reading the Kernel to Breaking It — Dirty Cow (CVE-2016-5195) End to End

I've been reading Robert Love's Linux Kernel Development. Chapter 15 covers the memory subsystem — virtual memory areas, page faults, Copy-on-Write. It's dense. I got through it, understood it concept

0

NONetomize Official Blogblog.netomize.caApr 24 · 7 min read

Detect Shulfar Malware Encrypted TCP C&C Traffic Using PacketSmith Yara-X Detection Module

Introduction Splunk published a blog post about a variant of the Gh0stRat malware family used in a new campaign delivered alongside the CloverPlus adware. The blog post is titled "Not Just Annoying Ad

0

PPromisepromise-security.hashnode.devApr 5 · 2 min read

Analysing a Simulated Web Breach with Splunk (Deloitte Forage Cyber Task)

1. Getting the logs into Splunk The task provided a web_activity.log file with HTTP requests grouped by internal IP addresses. My first step was to bring this data into Splunk so I could query and vis

0

#detection-engineering

#detection-engineering

Explore Hashnode

Trending tags this week

Building a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just Attackers

Building a Sentinel Detection Lab, Part 5: MFA Registration, a Missing License, and the First Detection That Talks Back

Building a Sentinel Detection Lab, Part 4: Catching Reconnaissance — and the Case-Sensitivity Bug That Made It Look Broken

Building a Sentinel Detection Lab, Part 3: My Detection Flagged Legitimate Windows Behavior — Here's How I Tuned It Without Going Blind

Building a Sentinel Detection Lab, Part 2: Suspicious PowerShell, and Why Some Detections Need No Threshold

Bridging the Detection-Exploitation Gap with AI: Building PentestX

Active Directory Certificate Services Abuse: The Hidden Path to Domain Compromise

From Reading the Kernel to Breaking It — Dirty Cow (CVE-2016-5195) End to End

Detect Shulfar Malware Encrypted TCP C&C Traffic Using PacketSmith Yara-X Detection Module

Analysing a Simulated Web Breach with Splunk (Deloitte Forage Cyber Task)

#detection-engineering

Search Hashnode

#detection-engineering

Explore Hashnode

Trending tags this week

Building a Sentinel Detection Lab, Part 8: Watching for Agents, Not Just Attackers

Building a Sentinel Detection Lab, Part 5: MFA Registration, a Missing License, and the First Detection That Talks Back

Building a Sentinel Detection Lab, Part 4: Catching Reconnaissance — and the Case-Sensitivity Bug That Made It Look Broken

Building a Sentinel Detection Lab, Part 3: My Detection Flagged Legitimate Windows Behavior — Here's How I Tuned It Without Going Blind

Building a Sentinel Detection Lab, Part 2: Suspicious PowerShell, and Why Some Detections Need No Threshold

Bridging the Detection-Exploitation Gap with AI: Building PentestX

Active Directory Certificate Services Abuse: The Hidden Path to Domain Compromise

From Reading the Kernel to Breaking It — Dirty Cow (CVE-2016-5195) End to End

Detect Shulfar Malware Encrypted TCP C&C Traffic Using PacketSmith Yara-X Detection Module

Analysing a Simulated Web Breach with Splunk (Deloitte Forage Cyber Task)