Blog
Threat HuntingWhat Is Threat Modeling in Cybersecurity?
Threat modeling is four questions. What are we working on, what can go wrong, what are we going to do about it, and did we do a good job. Adam Shostack published that frame in Threat Modeling:…
2025-03-029 min read
Threat HuntingWhat Are Hunting Rules? Queries Too Noisy to Alert On
SigmaHQ's rules-threat-hunting/ folder holds 140 rules. The rules/ folder beside it holds 3,137. Both describe attacker behaviour in the same YAML format, against the same log sources, with the same…
2024-11-078 min read
Threat HuntingWhat Is Threat Hunting? A Practical Guide for Modern SOCs
C:\Users\jhale\AppData\Local\Temp\Rar$EXa0.372\GUP.exe is the shape a side-loading host leaves behind. One host, one execution, a real vendor name in the file metadata, sitting inside a WinRAR…
2024-10-2710 min read
Threat HuntingWhat Is a Hypothesis-Driven Hunt?
Remote WMI process creation lands on the target as a child of C:\Windows\System32\wbem\WmiPrvSE.exe. That is one sentence of fact, and it is the entire reason the hunt below can exist. Without a fact…
2024-10-029 min read