← Blog // TAG

Detección

4 articles

Blue Team The Windows Event IDs every SOC should watch You don't need to watch 400 event types: you need the right ones. The Windows Event IDs that tell the story of an attac… Read → Blue Team From a CVE to a detection: from the advisory to a rule that catches the attack A CVE advisory tells you what breaks, not how to detect it. The method to go from an advisory to a detection: service a… Read → Blue Team Your first YARA rule: describe malware and hunt it YARA is the "grep" of malware analysis: rules that describe a family by its strings and bytes. The anatomy of a rule (m… Read → Blue Team From a log to a detection that works in any SIEM A KQL detection only works for Sentinel. With Sigma you write it once in YAML and convert it to KQL, SPL, Elastic or Wa… Read →