Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to rule.

Collection

Format

Rule PackMembers

Cloud identity and token theft detection pack for Entra ID and Okta

Four Sigma rules for the cloud identity attacks that actually land: illicit consent grants, authentication methods added after a risky sign-in, help-desk MFA resets, and session tokens replayed from a second address.

3 Sept 20261 min readT1078.004T1556.006T1550.001sigma detection-engineering rule-pack entra-id

Full write-up available to members subscribers. See what is included.

Rule PackPro+

Q3 detection rule pack: persistence and execution

Sigma, YARA and network rules built from the quarter's CISA advisories, with the advisory cited on every rule and the indicator table they came from attached as CSV.

25 Aug 20263 min readT1547.001T1059.001T1218.011sigma yara snort detection-engineering

Full write-up available to members subscribers. See what is included.