Resources
Things to deploy and things to print. Everything here carries a date and a version, because a detection rule with no date on it cannot be tuned: you cannot tell whether the false positives you are seeing were budgeted for or arrived with a product update.
Sigma, YARA and Snort, published as dated packs. Every rule ships with its false-positive notes, because a rule deployed without them is a rule that gets switched off in a fortnight.
Four Sigma rules for the cloud identity attacks that actually land: illicit consent grants, authentication methods added after a risky sign-in, help-desk MFA resets, and session tokens replayed from a second address.
2026-09-03 · members
A Sigma rule and an extracted IOC list for the persistence and execution techniques that showed up most in this quarter's casework, with measured false-positive budgets.
2026-08-25 · members
Built for a printer and for somebody who is standing up. These are pages rather than PDF binaries on purpose: when an event ID moves on a new build, a PDF on a desk stays wrong forever and a page can be corrected.
You have credible reason to believe a domain account has been compromised, or that someone has domain-level access they should not have.
Updated 2026-09-01
One Windows host is suspect. You have access, and you do not yet know whether it is compromised, what it ran, or whether anything is still live on it.
Updated 2026-09-01
Files are encrypting now, or encryption has stopped and you do not yet know whether the operator is still in the estate.
Updated 2026-09-01
