Research

Incident teardowns, detection engineering, reverse engineering and network forensics.

Collection

Format

Perfectly normal Windows behaviour that looks exactly like an intrusion. Every entry is something that has cost a real team a real night, with the benign explanation and the discriminator that separates it from the genuine article.

Analysis

False-Positive Hall of Fame No. 1: six alerts that were the software working

Chrome opens a pipe that Cobalt Strike also opens. Chrome's updater reads LSASS. Discord ships a signed binary that launches other binaries. Six alerts that fire on normal software, each with the benign explanation and the discriminator, and a count of how often the public rulebase admits any of this.

9 Sept 20268 min readT1003.001T1055T1218false-positive-hall-of-fame detection-engineering false-positives sigma