Task 1: Introduction

CVE-2026–35616 shows why endpoint management servers are not just admin consoles. They are fleet-wide execution platforms, and attackers…

Learn detection engineering basics through practical concepts and security monitoring workflows.

I just started a deep dive journey into Purple Teaming after finishing my four first years of engineering school. The first and main topic…

Back in April of this year, an AI-powered phishing campaign known as EvilTokens took the spotlight in the infosec world. While the term…

Build production-ready Snort detections: behaviour rules, tuning, suppression, and IOC lifecycle.

Beyond False Positives — Part 2

Learn to automate detection rules development and how AI can boost this process effectively.

The content in this article is written for educational purposes only and is to be practiced with consent. No material is to be replicated…

Why most Sigma and YARA rules never catch anything in production — and how to write ones that hold up across EDR, NDR, XDR, and SIEM

Most detection still sounds like this:

As frontier models slap on more classifiers to prevent cyber abuse, attackers and defenders are forced to switch to open weight models…

In the previous articles, I had been looking at activity through endpoint telemetry.

The matrix just changed for the first time in years — here’s what’s different and how detection engineers actually use it

A single executable as standard Windows user. Few seconds later SYSTEM shell. No password. No UAC prompt.

Threat hunting is a five-step loop — hypothesis, data, query, triage, detection — run over logs you already collect, looking for attacker…

Introduction

Walter Gómez — Parte 2 de 2 — Laboratorio reproducido en Proxmox con Wazuh 4.14.8

How I built, tested, and tuned 11 Splunk detections in a home lab — and what broke along the way