I just started a deep dive journey into Purple Teaming after finishing my four first years of engineering school. The first and main topic…

Back in April of this year, an AI-powered phishing campaign known as EvilTokens took the spotlight in the infosec world. While the term…

Build production-ready Snort detections: behaviour rules, tuning, suppression, and IOC lifecycle.

Beyond False Positives — Part 2

We're all petrified about missing a critical event or misclassifying an alert, but when we're talking about incident response (IR), there are often hundreds if not thousands of alerts to parse through. It's easy to get caught up with one alert because it…

Learn to automate detection rules development and how AI can boost this process effectively.

Learn to automate detection rules development and how AI can boost this process effectively.

The content in this article is written for educational purposes only and is to be practiced with consent. No material is to be replicated…

Why most Sigma and YARA rules never catch anything in production — and how to write ones that hold up across EDR, NDR, XDR, and SIEM

Most detection still sounds like this:

As frontier models slap on more classifiers to prevent cyber abuse, attackers and defenders are forced to switch to open weight models…

In the previous articles, I had been looking at activity through endpoint telemetry.

The matrix just changed for the first time in years — here’s what’s different and how detection engineers actually use it

A single executable as standard Windows user. Few seconds later SYSTEM shell. No password. No UAC prompt.

Threat hunting is a five-step loop — hypothesis, data, query, triage, detection — run over logs you already collect, looking for attacker…

Introduction

Walter Gómez — Parte 2 de 2 — Laboratorio reproducido en Proxmox con Wazuh 4.14.8

How I built, tested, and tuned 11 Splunk detections in a home lab — and what broke along the way

Detection engineering is both a role and an activity. It’s the discipline of building and maintaining the logic that identifies malicious or risky behavior within your organization. It’s where security analysis meets software engineering, turning raw logs…