Blog
Threat hunting and detection engineering, written down: the reporting behind rules, the telemetry that feeds them, and the gaps that get attackers through.
4 articles
Detection EngineeringWhat Is a Detection Rule? From Alerts to Analytics
ParentImage ends with \WINWORD.EXE and Image ends with \cmd.exe. That pair, plus a statement about which log it reads and what happens when it fires, is a complete detection rule. Everything else is…
2026-07-31 · 9 min read
Detection EngineeringWhat Is a Sigma Rule Catalog and Why Your SOC Needs One
On 2023-12-15 SigmaHQ changed the rule carrying id 5cc90652-4cbd-4241-aa3b-4b462fa5a248. The change added dnsgetdc: to the flag list and stripped the leading slash from most of the other strings, so…
2026-07-31 · 9 min read
Detection EngineeringWhat Is Detection Engineering?
vssadmin.exe delete shadows /all /quiet maps to T1490, Inhibit System Recovery. Writing the Sigma rule for it takes about ten minutes. Everything after those ten minutes is detection engineering.…
2026-07-31 · 8 min read
Detection EngineeringWhat Are Sigma Rules? The Open Detection Standard Explained
A Sigma rule is a YAML file with three required blocks: title, logsource and detection. Everything else is metadata. That is the whole format. The point of it is that the same file compiles to a…
2026-07-31 · 7 min read