--- title: "#detection-engineering articles | Hashnode" description: "Explore 44 articles tagged #detection-engineering on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/detection-engineering" --- Tag # #detection-engineering 44 posts · 0 followers [0x8r41nr07](https://hashnode.com/@0x8r41nr07) · [1d ago](https://hashnode.com/posts/3-wazuh-detections-home-lab/6af6ba5a9bafc90cbe817aa2) ### [3 Wazuh detections I wrote and tested in my home lab](https://braindump.0x8r41nr07.xyz/3-wazuh-detections-home-lab?utm_source=hashnode&utm_medium=feed) Three detections from my home SOC lab, each written by hand for Wazuh, tested against a real attack, and checked for false positives. For every one I followed the same loop: trigger the attack → find 6 min read · [braindump.0x8r41nr07.xyz](https://braindump.0x8r41nr07.xyz/3-wazuh-detections-home-lab?utm_source=hashnode&utm_medium=feed) [Ilja Krasnjanski](https://hashnode.com/@iljakrasnjanski) · [Nov 2](https://hashnode.com/posts/detection-engineering/6ae8581bb54b5d103cfc4d8c) ### [Building and Testing Detections for UNK\_DeadDrop](https://unk-deaddrop.hashnode.dev/detection-engineering?utm_source=hashnode&utm_medium=feed) Thirty-three YARA rules replayed against retained artifacts, followed by a separate noise review and static scanner evaluation. 7 min read · [unk-deaddrop.hashnode.dev](https://unk-deaddrop.hashnode.dev/detection-engineering?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/detection-engineering/6ae8581bb54b5d103cfc4d8c) [Shoban Chiddarth](https://hashnode.com/@shobanchiddarth) · [Nov 2](https://hashnode.com/posts/my-experience-contributing-to-cybersecurity-open-source/6ae848047d7620a0693e1ac3) ### [My experience contributing to cybersecurity Open Source](https://shobanchiddarth.hashnode.dev/my-experience-contributing-to-cybersecurity-open-source?utm_source=hashnode&utm_medium=feed) SigmaHQ rule to detect AWS S3 bucket being made public 5 min read · [shobanchiddarth.hashnode.dev](https://shobanchiddarth.hashnode.dev/my-experience-contributing-to-cybersecurity-open-source?utm_source=hashnode&utm_medium=feed) [Kgosi\_CS](https://hashnode.com/@Kgosi_CS) · [Nov 1](https://hashnode.com/posts/ocsf-explained/6ae726e273a225e7c9ce854f) ### [OCSF Explained: One Schema for Every Security Event](https://kgositshepo.hashnode.dev/ocsf-explained?utm_source=hashnode&utm_medium=feed) How the Open Cybersecurity Schema Framework gives security data a common language, and how to start using it. Security teams collect more data than ever, but much of it doesn't line up. A firewall, an 9 min read · [kgositshepo.hashnode.dev](https://kgositshepo.hashnode.dev/ocsf-explained?utm_source=hashnode&utm_medium=feed) [Tirthak Likhar](https://hashnode.com/@tirthak10) · [Sep 11](https://hashnode.com/posts/climbing-the-pyramid-of-pain-from-hashes-to-ttp-based-detection/6aa4219dfef57149febae21c) ### [Climbing the Pyramid of Pain: From Hashes to TTP-Based Detection](https://tirthaklikhar.hashnode.dev/climbing-the-pyramid-of-pain-from-hashes-to-ttp-based-detection?utm_source=hashnode&utm_medium=feed) What TryHackMe Summit teaches beginner SOC analysts about building detections attackers cannot easily evade 22 min read · [tirthaklikhar.hashnode.dev](https://tirthaklikhar.hashnode.dev/climbing-the-pyramid-of-pain-from-hashes-to-ttp-based-detection?utm_source=hashnode&utm_medium=feed) [Kajal Dhanjal](https://hashnode.com/@kajalbuilds) · [Sep 9](https://hashnode.com/posts/mitre-attack-v18-v19-detection-strategies/6aa117b3ae200d6994aa1ad5) ### [The MITRE ATT&CK most people are learning was retired in October 2025.](https://kajalbuilds.hashnode.dev/mitre-attack-v18-v19-detection-strategies?utm_source=hashnode&utm_medium=feed) MITRE retired the Detections field and Data Sources in v18, and split Defense Evasion in v19. What replaced them, and how to read ATT&CK now. 6 min read · [kajalbuilds.hashnode.dev](https://kajalbuilds.hashnode.dev/mitre-attack-v18-v19-detection-strategies?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 8](https://hashnode.com/posts/intro-to-detection-engineering-tryhackme/6a9ff52033e1e39e6d4226e1) ### [Intro to Detection Engineering (TryHackMe)](https://www.sharonjebitok.com/intro-to-detection-engineering-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the challenge on TryHackMe: Intro to Detection Engineering Introduction Detection engineering is an important role and task for a security analyst. It involves developing processes that will g 20 min read · [sharonjebitok.com](https://www.sharonjebitok.com/intro-to-detection-engineering-tryhackme?utm_source=hashnode&utm_medium=feed) [Manju Lalwani](https://hashnode.com/@infrashield) · [Aug 30](https://hashnode.com/posts/building-a-modular-kubernetes-deception-tool-kube-coy/6a946a5f0a6c0767f125561e) ### [Building a Modular Kubernetes Deception Tool \[kube-coy\]](https://mavericksec.hashnode.dev/building-a-modular-kubernetes-deception-tool-kube-coy?utm_source=hashnode&utm_medium=feed) A deep dive into building lightweight Kubernetes deception scenarios for defenders — one YAML at a time. 6 min read · [mavericksec.hashnode.dev](https://mavericksec.hashnode.dev/building-a-modular-kubernetes-deception-tool-kube-coy?utm_source=hashnode&utm_medium=feed) [Kajal Dhanjal](https://hashnode.com/@kajalbuilds) · [Aug 18](https://hashnode.com/posts/anatomy-of-an-identity-compromise/6a8435894bf6c7f3da41b104) ### [Anatomy of an identity compromise](https://kajalbuilds.hashnode.dev/anatomy-of-an-identity-compromise?utm_source=hashnode&utm_medium=feed) A login-only intrusion, step by step, and where the detection actually lives 12 min read · [kajalbuilds.hashnode.dev](https://kajalbuilds.hashnode.dev/anatomy-of-an-identity-compromise?utm_source=hashnode&utm_medium=feed) [Netomize Official Blog](https://hashnode.com/@mfmokbel) · [Aug 14](https://hashnode.com/posts/detect-icmp-ghost-implant-icmp-and-dns-tunnelling-c2-traffic-using-packetsmith-yara-x-icmp-detection-modules/6a7f26a36277c20363537eb4) ### [Detect ICMP-Ghost Implant ICMP and DNS Tunnelling C2 Traffic Using PacketSmith Yara-X & ICMP Detection Modules](https://blog.netomize.ca/detect-icmp-ghost-implant-icmp-and-dns-tunnelling-c2-traffic-using-packetsmith-yara-x-icmp-detection-modules?utm_source=hashnode&utm_medium=feed) Introduction ICMP-Ghost is an open-source tunnelling framework written in pure x64 assembly. What stands out about this framework, compared to other closed- and open-source ones, is the author's claim 12 min read · [blog.netomize.ca](https://blog.netomize.ca/detect-icmp-ghost-implant-icmp-and-dns-tunnelling-c2-traffic-using-packetsmith-yara-x-icmp-detection-modules?utm_source=hashnode&utm_medium=feed) [6](https://hashnode.com/posts/detect-icmp-ghost-implant-icmp-and-dns-tunnelling-c2-traffic-using-packetsmith-yara-x-icmp-detection-modules/6a7f26a36277c20363537eb4)