Resources
Things to deploy and things to print. Everything here carries a date and a version, because a detection rule with no date on it cannot be tuned: you cannot tell whether the false positives you are seeing were budgeted for or arrived with a product update.
Sigma, YARA and Snort, published as dated packs. Every rule ships with its false-positive notes, because a rule deployed without them is a rule that gets switched off in a fortnight.
Four Sigma rules for the cloud identity attacks that actually land: illicit consent grants, authentication methods added after a risky sign-in, help-desk MFA resets, and session tokens replayed from a second address.
2026-09-03 · members
Sigma, YARA and network rules built from the quarter's CISA advisories, with the advisory cited on every rule and the indicator table they came from attached as CSV.
2026-08-25 · members
Built for a printer and for somebody who is standing up. These are pages rather than PDF binaries on purpose: when an event ID moves on a new build, a PDF on a desk stays wrong forever and a page can be corrected.
You have credible reason to believe a domain account has been compromised, or that someone has domain-level access they should not have.
Updated 2026-09-01
One Windows host is suspect. You have access, and you do not yet know whether it is compromised, what it ran, or whether anything is still live on it.
Updated 2026-09-01
Files are encrypting now, or encryption has stopped and you do not yet know whether the operator is still in the estate.
Updated 2026-09-01
A Linux server is behaving oddly, has been flagged by a detection, or turned up in somebody else’s incident as a destination.
Updated 2026-09-12
A sign-in you cannot account for, an inbox rule nobody created, or a user reporting that a colleague is sending them things the colleague did not send.
Updated 2026-09-12
An incident with a start date more than a fortnight ago, and a decision about what to export right now before it stops existing.
Updated 2026-09-12
A host you suspect is compromised is still running, and somebody is about to be helpful and reboot it.
Updated 2026-09-12
A Mac has been flagged, or turned up in an incident, and most of your Windows instincts do not transfer.
Updated 2026-09-12
You are collecting something that may end up in an employment matter, an insurance claim, a regulatory response or a court.
Updated 2026-09-12
Credentials you did not issue, resources nobody created, or a provider notice that a key of yours is public.
Updated 2026-09-12
