Detection engineering for modern blue teams.
10 Sept 2026
Every EDR has things it doesn't show you, and most of them are not bugs, they're design. Here's where the sensor goes quiet in 2026, how I figure out what's missing, and the extra telemetry and coverage I lean on so the quiet spots aren't where an intrusion lives.
19 Aug 2026
Every guide tells you to alert on event 4769. Nobody tells you that 4769 is one of the highest-volume events your domain controllers produce, so a naive rule buries you. Here's how I filter it down to the requests that are actually an attack, and the honeypot trick that skips the noise entirely.
19 Aug 2026
Most Sysmon configs I inherit are either the default (which sees almost nothing useful) or a 4,000-line monster tuned for someone else's environment. Here are the event types that earn their place on the endpoint, what each one catches, and where the false positives come from.
13 Aug 2026
Token stealing elevates from a high-integrity process to SYSTEM by duplicating another process token, and it does it quietly. Two Sysmon events see it if you point them at the right processes and read the access mask instead of the image name.
9 Aug 2026
The Background Intelligent Transfer Service is still a quiet way to download a payload, run a command on job completion, and survive a reboot without dropping an obvious autorun. Here is where the telemetry lives, the three event IDs that actually help, and how to tune out Windows Update.
5 Aug 2026
Parent-child anomaly rules are some of the highest-value detections you can write, and also the ones that drown you in false positives. Here is how we scope one when there is no production EDR telemetry to learn the benign baseline from: read the parent binary itself.
1 Aug 2026
A working method for turning an attack technique into a rule that survives contact with a real attacker: find the primitive the technique cannot avoid, test whether the change is rare, weigh how cheaply it can be bypassed, and check it carries enough context to page someone over.
28 Jul 2026
Registry symbolic links let one key transparently resolve to another, which makes them a tidy hiding spot. Here is how the SymbolicLinkValue tell surfaces in Sysmon registry telemetry and how we alert on it.
24 Jul 2026
The usual share-access events are noisy and often off. A quieter way to catch lateral file staging is to watch the receiving host, where inbound SMB writes show up under the System account in Sysmon file-creation telemetry.
21 Jul 2026
The endpoint-and-network detections you learned for lateral movement still fire, but they're covering a smaller slice of what actually happens now. The shift is toward identity telemetry, RMM abuse, and living-off-the-land. Here's what I'd tune first in 2026.
20 Jul 2026
Remote support software is a blessed insider on most networks, which is exactly why attackers reach for it. How we hunt abnormal TeamViewer and RMM sessions with process, file, and network telemetry in 2026.
16 Jul 2026
Copying the AD database off a domain controller is quiet on the wire but noisy in the Application log. A 2026 walk through the ESENT, VSS, and Sysmon traces that actually catch NTDS extraction.