#DetectionEngineering

Great list of resources for anyone getting started in #detectionengineering (h/t to Richard Akroyd for creating this list)

🚨New Module on Want to get started with detection engineering? Why not jump in and build some?🕵️‍♂️🔎 In this module we cover the core principles and put them to use making kerberoasting detections. Let's do it! #DetectionEngineering #DFIR

@datadoghq Detect is only 10 days away 🔥 I'll be showcasing a deep dive of the GATES method /skill at the Sears Tower here in the chi! If you are local to #chicago and want to talk #detectionengineering sign up! Let's connect.

I started transforming my internal "Detection Engineering Cheat Sheet" that I've created for my team into a more generic version - I'll share it when I have included all feedback and reflected on it a bit more #DetectionEngineering

Detection engineering is complicated, but this new 5 tier maturity model from @stryker0x, @_xDeJesus, and @SBousseaden provides guidance for security teams: #ElasticSecurityLabs #detectionengineering #maturitymodel

ICYMI yesterday we released our latest video: Tuning Rules with Security Onion Detections #DetectionEngineering BY defenders FOR defenders! via @YouTube

What people often overlook in #DetectionEngineering is that there’s no "one-size-fits-all" rule to detect a threat. It depends on your goals. How specific should the rule be? Are you tracking a threat actor, detecting the tool/malware, or focusing on the technique? Should it be based on code, content, form, or metadata? Just like in art, you can create an abstract, impressionist, or realistic painting of the same subject, and all can be masterpieces in their own right

Query for Splunk changes what a detection can see, without changing how your team works: 1. Open a #Splunk detection 2. Add a call to Query in the SPL 3. It now runs across data you never ingested Same SPL. No new pipeline. No re-ingest. #DetectionEngineering #cybersecurity

Detection engineering: a proactive blend of software engineering, data science, and SecOps. Alex Hurtado defines it as building custom threat detections in dynamic environments. It's sophisticated, it's essential. #DetectionEngineering #Cybersecurity

Detection-as-Code: From Concept to Practice 👇 Check out @_st0pp3r_ latest blog series, where he unpacks the fundamentals of #DetectionEngineering and takes a closer look at the game-changing concept of #DetectionAsCode.

📅 Releasing my course next week! I'm solving majority of the decade-old problems in SOC, without AI. Fundamental data analysis methods is all you need. #ThreatHunting #DetectionEngineering

This is the follow-up you've been waiting for: The #DetectionEngineering Blog Post Part 6 by @_st0pp3r_ You'll gain insights on manual, release-based, automatic and multitenant deployments to optimize #ContinuousDeployment processes and more.

Detecting lateral movement with extremely high precision and recall shouldn't be this easy. 😮 #ThreatHunting #DetectionEngineering

Back to blogging. AV configuration has an interesting impact on EDR telemetry, at least for MDE. If you are simulating stuff with AV disabled, bad news. #ThreatHunting #DetectionEngineering

In April, #ElasticSecurityLabs published 62 new rules! Take a look at the overview and learn how we manage these rulesets: #detectionengineering #SIEM #EDR

Documentation is key in #DetectionEngineering! Automate it with Jinja & Git for streamlined processes. Plus, generate changelogs to keep teams informed and improve collaboration. Discover more in @_st0pp3r_ latest blogpost 👉

🚨 Brace yourself for Windows Hello for Business attacks. #ThreatHunting #DetectionEngineering

This is such a wonderfully detailed and clearly-explained DFIR Report - even though the intrusion was long and complex, the detection opportunities are easy take-aways for #threathunting and #detectionengineering

SEO Poisoning to Domain Control: The Gootloader Saga Continues 🌟Analysis and reporting completed by @_pete_0, @malforsec & @r3nzsec 🎵Audio: Available on Spotify, Apple, YouTube and more! 🏹Services: 📚Report:

🚨 I've added the detection engineering lab and put all the free labs into a single section. Will be adding more stuff in the coming weeks/months. Link below👇 #ThreatHunting #DetectionEngineering #DFIR #Kusto #KQL

Just read the "Discussion" section. The paper starts like "we achieved huge success, detection engineering is solved with AI", and then everything starts collapsing when you read the evaluation scores (table 6) and the discussion section. #ThreatHunting #DetectionEngineering