Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to false-positives.

Collection

Format

Analysis

False-Positive Hall of Fame No. 1: six alerts that were the software working

Chrome opens a pipe that Cobalt Strike also opens. Chrome's updater reads LSASS. Discord ships a signed binary that launches other binaries. Six alerts that fire on normal software, each with the benign explanation and the discriminator, and a count of how often the public rulebase admits any of this.

9 Sept 20268 min readT1003.001T1055T1218false-positive-hall-of-fame detection-engineering false-positives sigma