Blog › Detection Engineering

Detection Engineering

Detection rules that survive contact with production: what a rule actually fires on, how to measure coverage against ATT&CK, and how to tune without losing the true positives. KQL, Sigma and SPL, side by side.

15 articles

4 August 2026 · 11 min read

The Hunt That Found Nothing

An advisory lands, you sweep the estate, nothing comes back. A fleet-wide clean result has a numerator and no denominator, which is not the same as safe.

21 July 2026 · 9 min read

One Failed Login Is Noise. The Same Failure Across Sixty Accounts Is a Spray Your Rule Can't Count.

Brute force and password spray produce the same failed sign-in event. A per-account threshold catches one and misses the other entirely.

14 July 2026 · 9 min read

Your Sigma Rule Converts Cleanly and Still Never Fires. Here's the Test That Catches It.

A one-character field typo passes sigma check, converts to valid KQL and SPL, and matches nothing. Static validation cannot prove a rule works.

2 July 2026 · 11 min read

Detecting Malicious Scheduled Tasks: The Persistence That Survives Your Cleanup

Detect T1053.005 scheduled task persistence with KQL, SPL and Sigma, using Event ID 4698 and a scoring model that separates attacker tasks from admin ones.

16 June 2026 · 10 min read

Catch C2 Beaconing by Its Cadence in Sentinel and Splunk

IP and domain indicators expire within days. The interval a beacon sleeps on does not. How to score connection cadence in Sentinel and Splunk.

15 June 2026 · 9 min read

The EC2 Credential-Theft Detection Most Teams Ship Wrong

Alerting on AssumedRole from outside AWS buries you in SSO noise. Here is the marker that isolates a stolen EC2 instance credential from the rest.

9 June 2026 · 9 min read

Your Noisy Rule Has 200 False Positives a Day. Don't Suppress the Field That's Making Noise.

The fastest way to quiet a noisy rule is to exclude the field making the noise. It is also the fastest way to cut a hole the attacker walks through.

4 June 2026 · 9 min read

KQL SigninLogs, The 10 Queries Every SOC Analyst Runs First

Ten KQL queries against SigninLogs that answer what SOC analysts actually ask during an identity investigation, copy-paste ready with annotated output.

2 June 2026 · 9 min read

You Deployed 350 Detection Rules. Only 50 Fire Regularly. Are the Other 300 Working?

Most detection libraries are full of rules that have never fired. Silent rules are not coverage, they are assumptions. How to find and validate them.

20 May 2026 · 12 min read

Credential Access Detection Beyond LSASS, The Five Techniques Your Rules Are Missing

LSASS dump detection is table stakes. Kerberoasting, DCSync, DPAPI abuse, SAM extraction, and token theft each need different KQL.

19 May 2026 · 9 min read

Is Your Detection Program Effective? And How Would You Know?

Most organizations can't prove their detection program works. Here's what effective looks like and the four numbers that prove it.

16 May 2026 · 10 min read

KQL Sign-In Log Analysis, What ResultType != 0 Actually Tells You

KQL sign-in log analysis: what ResultType values mean, how to detect password spray, MFA fatigue, and CA blocks in Sentinel.

3 May 2026 · 9 min read

Five KQL Threat Hunts Every M365 SOC Should Run This Month

Your detection rules cover known patterns. These five KQL hunts find the attacker activity that bypasses every analytics rule in your library.

15 April 2026 · 7 min read

The M365 Detections Microsoft Doesn't Give You

Microsoft ships 200+ Sentinel rule templates but leaves gaps in mailbox abuse, consent grants, and privilege escalation. Five rules to build.

7 April 2026 · 5 min read

Five auditd Rules That Catch Kernel Module Rootkits Before They Load

Most Linux rootkits load as kernel modules. Five auditd rules that detect module loading, modification, and persistence techniques.

Go deeper on detection engineering

Course Threat Detection Engineering Preview the first module free → Course Sigma Rules for Detection Engineers Preview the first module free →