Blog
Detection EngineeringWriting a Sigma rule from scratch, field by field
A Sigma rule has exactly three mandatory keys: title, logsource and detection. Everything else is optional in the specification, which is why so many first drafts parse cleanly and still get rejected…
2026-08-018 min read
Detection EngineeringBaselines in detection engineering: what to actually measure
Microsoft counts more than 3,000 group policy settings in Windows 10, plus over 1,800 more for Internet Explorer 11, and says only some of those roughly 4,800 settings are security relevant. That is…
2026-08-019 min read1 likes
Guides & TutorialsPlaybooks in threat hunting and incident response, in practice
A CACAO playbook is a JSON object with an id, a created timestamp and a workflow dictionary keyed by step identifiers. A Microsoft Sentinel playbook is an Azure Logic Apps workflow triggered by an…
2026-08-018 min read
Guides & TutorialsWhat Is MITRE ATT&CK? Tactics, Techniques and Rule Tagging
The Enterprise matrix on attack.mitre.org lists 15 tactic columns, and Discovery alone carries 34 techniques. Persistence holds 22, Execution 20, Command and Control 18. Those columns are not a kill…
2026-08-018 min read
Product UpdatesHow to Choose Which Sigma Rules to Deploy First
Event ID 4688 carries no command line until you turn on one Group Policy setting. Audit Process Creation logs the new process name and the parent, and that is all. Enable "Include command line in…
2026-07-288 min read
Product UpdatesWhat Is a Managed Sigma Rule Service?
git clone https://github.com/SigmaHQ/sigma gives you 4,244 YAML files. On 31 July 2026 the repository carried 3,137 rules under rules/, 470 under rules-emerging-threats/, 140 under…
2026-07-248 min read
Product UpdatesWhat Is Rule Validation in HuntRule?
Two selections, AND-ed together. One asks for Image|endswith: '\rundll32.exe', the other for Image|endswith: '\regsvr32.exe'. The YAML is valid. Every linter you own will pass it. It will also never…
2026-07-128 min read
Product UpdatesWhat Is a Rule Lifecycle in HuntRule?
A rule enters the catalog as a line of git diff output and leaves it as a D1 row with lifecycle = 'published'. Everything between those two facts is the lifecycle. Two vocabularies drive it, and they…
2026-07-088 min read
Product UpdatesWhat Is HuntRule? A Sigma Rule Catalog for Detection Engineers
git clone https://github.com/SigmaHQ/sigma gives you every rule and almost none of what you need to deploy one. git clone https://github.com/SigmaHQ/sigma find sigma/rules -name '*.yml' | head -3 You…
2026-06-257 min read
Supply Chain SecurityWhat Is a Build Pipeline Compromise?
SolarWinds.Orion.Core.BusinessLayer.dll shipped with a valid SolarWinds Authenticode signature and a backdoor inside the same assembly. The git history was clean. The certificate was the real one.…
2026-06-149 min read
Supply Chain SecurityWhat is CI/CD security?
On 14 and 15 March 2025 the tags v1 through v45.0.7 of tj-actions/changed-files were repointed to commit 0e58ed8. The injected updateFeatures code read secrets out of the runner process and printed…
2026-05-2712 min read
Supply Chain SecurityWhat Is Typosquatting in Package Repositories?
On 19 July 2017 an npm user named hacktask published a package called crossenv. The popular package is cross-env. The squat read the environment variables of whatever machine installed it and sent…
2026-05-2110 min read