Detection engineering for modern blue teams.https://menasec.net/https://menasec.net/2026/09/edr-telemetry-blind-spots/https://menasec.net/2026/09/edr-telemetry-blind-spots/Every EDR has things it doesn't show you, and most of them are not bugs, they're design. Here's where the sensor goes quiet in 2026, how I figure out what's missing, and the extra telemetry and coverage I lean on so the quiet spots aren't where an intrusion lives.Thu, 10 Sep 2026 00:00:00 GMThttps://menasec.net/2026/08/kerberoasting-detection-blue-side/https://menasec.net/2026/08/kerberoasting-detection-blue-side/Every guide tells you to alert on event 4769. Nobody tells you that 4769 is one of the highest-volume events your domain controllers produce, so a naive rule buries you. Here's how I filter it down to the requests that are actually an attack, and the honeypot trick that skips the noise entirely.Wed, 19 Aug 2026 00:00:00 GMThttps://menasec.net/2026/08/sysmon-baseline-2026/https://menasec.net/2026/08/sysmon-baseline-2026/Most Sysmon configs I inherit are either the default (which sees almost nothing useful) or a 4,000-line monster tuned for someone else's environment. Here are the event types that earn their place on the endpoint, what each one catches, and where the false positives come from.Wed, 19 Aug 2026 00:00:00 GMThttps://menasec.net/2021/12/detecting-token-stealing-using-sysmon/https://menasec.net/2021/12/detecting-token-stealing-using-sysmon/Token stealing elevates from a high-integrity process to SYSTEM by duplicating another process token, and it does it quietly. Two Sysmon events see it if you point them at the right processes and read the access mask instead of the image name.Thu, 13 Aug 2026 00:00:00 GMThttps://menasec.net/2021/05/hunting-for-suspicious-usage-of/https://menasec.net/2021/05/hunting-for-suspicious-usage-of/The Background Intelligent Transfer Service is still a quiet way to download a payload, run a command on job completion, and survive a reboot without dropping an obvious autorun. Here is where the telemetry lives, the three event IDs that actually help, and how to tune out Windows Update.Sun, 09 Aug 2026 00:00:00 GMThttps://menasec.net/2021/01/how-to-design-abnormal-child-processes/https://menasec.net/2021/01/how-to-design-abnormal-child-processes/Parent-child anomaly rules are some of the highest-value detections you can write, and also the ones that drown you in false positives. Here is how we scope one when there is no production EDR telemetry to learn the benign baseline from: read the parent binary itself.Wed, 05 Aug 2026 00:00:00 GMThttps://menasec.net/2020/11/how-to-design-detection-logic-part-1/https://menasec.net/2020/11/how-to-design-detection-logic-part-1/A working method for turning an attack technique into a rule that survives contact with a real attacker: find the primitive the technique cannot avoid, test whether the change is rare, weigh how cheaply it can be bypassed, and check it carries enough context to page someone over.Sat, 01 Aug 2026 00:00:00 GMThttps://menasec.net/2020/09/discovering-windows-registry-symbolic/https://menasec.net/2020/09/discovering-windows-registry-symbolic/Registry symbolic links let one key transparently resolve to another, which makes them a tidy hiding spot. Here is how the SymbolicLinkValue tell surfaces in Sysmon registry telemetry and how we alert on it.Tue, 28 Jul 2026 00:00:00 GMThttps://menasec.net/2020/08/new-trick-to-detect-lateral-movement/https://menasec.net/2020/08/new-trick-to-detect-lateral-movement/The usual share-access events are noisy and often off. A quieter way to catch lateral file staging is to watch the receiving host, where inbound SMB writes show up under the System account in Sysmon file-creation telemetry.Fri, 24 Jul 2026 00:00:00 GMThttps://menasec.net/2026/07/detecting-lateral-movement-2026/https://menasec.net/2026/07/detecting-lateral-movement-2026/The endpoint-and-network detections you learned for lateral movement still fire, but they're covering a smaller slice of what actually happens now. The shift is toward identity telemetry, RMM abuse, and living-off-the-land. Here's what I'd tune first in 2026.Tue, 21 Jul 2026 00:00:00 GMThttps://menasec.net/2019/11/hunting-for-suspicious-use-of/https://menasec.net/2019/11/hunting-for-suspicious-use-of/Remote support software is a blessed insider on most networks, which is exactly why attackers reach for it. How we hunt abnormal TeamViewer and RMM sessions with process, file, and network telemetry in 2026.Mon, 20 Jul 2026 00:00:00 GMThttps://menasec.net/2019/11/forensics-traces-of-ntdsdit-dumping/https://menasec.net/2019/11/forensics-traces-of-ntdsdit-dumping/Copying the AD database off a domain controller is quiet on the wire but noisy in the Application log. A 2026 walk through the ESENT, VSS, and Sysmon traces that actually catch NTDS extraction.Thu, 16 Jul 2026 00:00:00 GMThttps://menasec.net/2019/07/interesting-difr-traces-of-net-clr/https://menasec.net/2019/07/interesting-difr-traces-of-net-clr/Every time a managed executable runs, the CLR quietly writes a small log file named after it. It survives deletion, it names the tool, and hardly anyone collects it. Here's what it catches and where it goes blind.Sun, 12 Jul 2026 00:00:00 GMThttps://menasec.net/2019/04/the-impact-of-network-level/https://menasec.net/2019/04/the-impact-of-network-level/NLA is a good control that quietly breaks a detection a lot of teams still rely on. Once it's on, the failed-RDP signal you were watching moves, and the source IP you wanted ends up in a log you probably haven't enabled.Wed, 08 Jul 2026 00:00:00 GMThttps://menasec.net/2019/04/detecting-namedpipe-pivoting-using/https://menasec.net/2019/04/detecting-namedpipe-pivoting-using/SMB-linked beacons and PsExec-style tools talk over named pipes, which suits the operator because pipes are invisible to the network sensor and buried in noise on the host. Here is how I pull the pivot out of that noise.Sat, 04 Jul 2026 00:00:00 GMThttps://menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for/https://menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for/A scheduled task is two detections wearing one name. One is quiet persistence that survives reboots; the other is a remote-execution hop that plants a task over the network. Different telemetry, different tuning, one technique ID.Mon, 29 Jun 2026 00:00:00 GMThttps://menasec.net/2019/03/initial-access-execution-evidences-for/https://menasec.net/2019/03/initial-access-execution-evidences-for/Certutil.exe was built to manage certificates and is best known for quietly pulling down whatever you point it at. The command line gives it away every time, and so does the decode variant. Here is the detection and where it still slips past.Wed, 24 Jun 2026 00:00:00 GMThttps://menasec.net/2019/03/how-to-hunt-for-processes-starting-from/https://menasec.net/2019/03/how-to-hunt-for-processes-starting-from/Autostart persistence is decades old and still works, because the process it launches looks like a normal child of a normal parent. We hunt the launch itself here, from the registry write through to the process that appears at logon, on Sysmon telemetry.Fri, 19 Jun 2026 00:00:00 GMThttps://menasec.net/2019/03/an-overview-of-windows-eventid-4648/https://menasec.net/2019/03/an-overview-of-windows-eventid-4648/Event 4648 fires whenever a process supplies credentials that differ from the logged-on user. That makes it a decent lateral-movement and credential-reuse signal and a genuine false-positive machine. Here is how I read the three fields that matter and tune the rest out.Sun, 14 Jun 2026 00:00:00 GMThttps://menasec.net/2019/02/threat-hunting-doc-with-macro-invoking/https://menasec.net/2019/02/threat-hunting-doc-with-macro-invoking/The standard malicious-macro rule watches for winword.exe spawning cmd or PowerShell. A macro that launches its payload through WMI or a shell COM object breaks that parent-child link on purpose. Here is how to detect it without depending on Office being the parent.Tue, 09 Jun 2026 00:00:00 GMThttps://menasec.net/2019/02/threat-hunting-25-rdp-over-reverse-ssh/https://menasec.net/2019/02/threat-hunting-25-rdp-over-reverse-ssh/An attacker who can't reach RDP through the firewall can still pull the session out over a reverse SSH tunnel, and the giveaway is a remote desktop logon whose source address is the loopback. Here is how we detect it in 2026.Thu, 04 Jun 2026 00:00:00 GMThttps://menasec.net/2019/02/threat-hunting-24-microsoft-windows-dns/https://menasec.net/2019/02/threat-hunting-24-microsoft-windows-dns/Client-side DNS telemetry only covers the hosts you instrumented. The Windows DNS Server analytical channel logs every query the resolver answers, including the ones no endpoint agent ever saw. Here is how I turn it on and what I hunt in it.Sat, 30 May 2026 00:00:00 GMThttps://menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr/https://menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr/Attackers stopped bringing mimikatz to the party. They dump LSASS with signed tools you already trust, ProcDump and Task Manager, and let a cracker do the rest offline. The catch isn't the tool name, it's the handle.Mon, 25 May 2026 00:00:00 GMThttps://menasec.net/2019/02/threat-hunting-18-lateral-movement-via/https://menasec.net/2019/02/threat-hunting-18-lateral-movement-via/ShellWindows and ShellBrowserWindow let an attacker run a command on a remote host through DCOM, and the payload lands as a child of explorer.exe with no one sitting at the keyboard. That mismatch is the whole detection.Wed, 20 May 2026 00:00:00 GMThttps://menasec.net/2019/02/threat-hunting-7-detecting/https://menasec.net/2019/02/threat-hunting-7-detecting/BloodHound's collector doesn't exploit anything. It just asks the domain a lot of questions, very fast, from one host. Two behaviors give it away, and one honeytoken makes the whole thing cheap to catch.Fri, 15 May 2026 00:00:00 GMT