Blog
Threat hunting and detection engineering, written down: the reporting behind rules, the telemetry that feeds them, and the gaps that get attackers through.
4 articles
Threat HuntingWhat Is Threat Modeling in Cybersecurity?
Threat modeling is four questions. What are we working on, what can go wrong, what are we going to do about it, and did we do a good job. Adam Shostack published that frame in Threat Modeling:…
2026-07-31 · 9 min read
Threat HuntingWhat Are Hunting Rules? Queries Too Noisy to Alert On
SigmaHQ's rules-threat-hunting/ folder holds 140 rules. The rules/ folder beside it holds 3,137. Both describe attacker behaviour in the same YAML format, against the same log sources, with the same…
2026-07-31 · 8 min read
Threat HuntingWhat Is Threat Hunting? A Practical Guide for Modern SOCs
C:\Users\jhale\AppData\Local\Temp\Rar$EXa0.372\GUP.exe is the shape a side-loading host leaves behind. One host, one execution, a real vendor name in the file metadata, sitting inside a WinRAR…
2026-07-31 · 10 min read
Threat HuntingWhat Is a Hypothesis-Driven Hunt?
Remote WMI process creation lands on the target as a child of C:\Windows\System32\wbem\WmiPrvSE.exe. That is one sentence of fact, and it is the entire reason the hunt below can exist. Without a fact…
2026-07-31 · 9 min read