Blog
Threat hunting and detection engineering, written down: the reporting behind rules, the telemetry that feeds them, and the gaps that get attackers through.
9 articles
Threat HuntingWhat Are Hunting Rules? Queries Too Noisy to Alert On
SigmaHQ's rules-threat-hunting/ folder holds 140 rules. The rules/ folder beside it holds 3,137. Both describe attacker behaviour in the same YAML format, against the same log sources, with the same…
2026-07-31 · 8 min read
Threat HuntingWhat Is Threat Hunting? A Practical Guide for Modern SOCs
C:\Users\jhale\AppData\Local\Temp\Rar$EXa0.372\GUP.exe is the shape a side-loading host leaves behind. One host, one execution, a real vendor name in the file metadata, sitting inside a WinRAR…
2026-07-31 · 10 min read
Guides & TutorialsWhat Is a Use Case Library in SOCs?
SigmaHQ's proc_access_win_lsass_memdump.yml fires when a process opens a handle to lsass.exe with an access mask in its list. That is one behaviour, on one platform, from one telemetry source. It…
2026-07-31 · 10 min read
Threat HuntingWhat Is a Hypothesis-Driven Hunt?
Remote WMI process creation lands on the target as a child of C:\Windows\System32\wbem\WmiPrvSE.exe. That is one sentence of fact, and it is the entire reason the hunt below can exist. Without a fact…
2026-07-31 · 9 min read
Guides & TutorialsWhat Is a Detection Playbook?
vssadmin.exe delete shadows /all /quiet runs on a file server at 03:12. The rule fires. The analyst on shift has been awake for nine hours and has never seen this alert before. What happens in the…
2026-07-31 · 9 min read
Detection EngineeringWhat Is a Detection Rule? From Alerts to Analytics
ParentImage ends with \WINWORD.EXE and Image ends with \cmd.exe. That pair, plus a statement about which log it reads and what happens when it fires, is a complete detection rule. Everything else is…
2026-07-31 · 9 min read
Detection EngineeringWhat Is a Sigma Rule Catalog and Why Your SOC Needs One
On 2023-12-15 SigmaHQ changed the rule carrying id 5cc90652-4cbd-4241-aa3b-4b462fa5a248. The change added dnsgetdc: to the flag list and stripped the leading slash from most of the other strings, so…
2026-07-31 · 9 min read
Detection EngineeringWhat Is Detection Engineering?
vssadmin.exe delete shadows /all /quiet maps to T1490, Inhibit System Recovery. Writing the Sigma rule for it takes about ten minutes. Everything after those ten minutes is detection engineering.…
2026-07-31 · 8 min read
Detection EngineeringWhat Are Sigma Rules? The Open Detection Standard Explained
A Sigma rule is a YAML file with three required blocks: title, logsource and detection. Everything else is metadata. That is the whole format. The point of it is that the same file compiles to a…
2026-07-31 · 7 min read