Blog
Detection EngineeringWriting a Sigma rule from scratch, field by field
A Sigma rule has exactly three mandatory keys: title, logsource and detection. Everything else is optional in the specification, which is why so many first drafts parse cleanly and still get rejected…
2026-08-018 min read
Detection EngineeringBaselines in detection engineering: what to actually measure
Microsoft counts more than 3,000 group policy settings in Windows 10, plus over 1,800 more for Internet Explorer 11, and says only some of those roughly 4,800 settings are security relevant. That is…
2026-08-019 min read1 likes
Detection EngineeringWhat Is a Data Source in Detection Engineering?
Windows event ID 4688 fires on every process creation. The Process Command Line field inside it is empty by default. Microsoft documents this plainly: the field arrived in event version 1 on Windows…
2026-03-187 min read
Detection EngineeringWhat Is a Detection Signal vs Noise?
powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand SQBu... That is a malicious command line in one estate and an Ansible task in the next one over. Ansible's…
2026-03-078 min read
Detection EngineeringWhat Is Security Telemetry?
Sysmon Event ID 3, network connection, is disabled by default. Microsoft says so in the Sysmon documentation, right above the note that it links every connection to a process through ProcessId and…
2026-02-169 min read
Detection EngineeringWhat Is a Detection Rule? From Alerts to Analytics
ParentImage ends with \WINWORD.EXE and Image ends with \cmd.exe. That pair, plus a statement about which log it reads and what happens when it fires, is a complete detection rule. Everything else is…
2024-09-139 min read
Detection EngineeringWhat Is a Sigma Rule Catalog and Why Your SOC Needs One
On 2023-12-15 SigmaHQ changed the rule carrying id 5cc90652-4cbd-4241-aa3b-4b462fa5a248. The change added dnsgetdc: to the flag list and stripped the leading slash from most of the other strings, so…
2024-08-299 min read
Detection EngineeringWhat Is Detection Engineering?
vssadmin.exe delete shadows /all /quiet maps to T1490, Inhibit System Recovery. Writing the Sigma rule for it takes about ten minutes. Everything after those ten minutes is detection engineering.…
2024-08-178 min read
Detection EngineeringWhat Are Sigma Rules? The Open Detection Standard Explained
A Sigma rule is a YAML file with three required blocks: title, logsource and detection. Everything else is metadata. That is the whole format. The point of it is that the same file compiles to a…
2024-08-127 min read