Encoded powershell is a smell. It is also every management tool. Graph parent + encoded, then decide. A smell is no…
echoThursday, 02:30
3 readingPeople paste tokens in command lines. I redacted known flags (--password, --token, AKIA...) at ingest. I still stor…
btbaliasMEMBERstarted 24 Aug 2026, 06:25
waitblkTuesday, 04:54
1 readingPID reused. The graph said WINWORD spawned cmd. It was a reused PID from a previous WINWORD. I now key on process G…
sgdtMEMBERstarted 15 Aug 2026, 20:28
mmiostaleTuesday, 04:34
5 readingIf your detection needs 10 days of baseline to fire, it is a report, not a detection. I want 10 minutes or I want a…
setnzMEMBERstarted 14 Jun 2026, 12:28
mdsmitMonday, 10:45
6 readingOne counter, one sparkline, one threshold that pages a human. The rest is a weekly review. If your SOC graph has 40…
sha256r19 Aug 2026, 11:58
1 readingpowershell.exe is not a detection. WINWORD → powershell is a detection. Named pipes and encoded commands are decora…
eliasetwMEMBERstarted 22 Dec 2025, 05:43
amxtile12 Aug 2026, 19:39
4 readingWINWORD → splwow64 is life. WINWORD → powershell is not. I keep a allow-tree, not an allow-list of images. Trees, n…
hotpathMEMBERstarted 4 Aug 2026, 19:06
paulnoble11 Aug 2026, 17:32
8 readingA burst in 1s is an exploit attempt. In 1h it is a backup job. I keep all three buckets for one rule and I am not s…
pltgotMEMBERstarted 31 Mar 2026, 09:39uart1655010 Aug 2026, 00:43
4 readingI dumped parquet 'for science'. I queried 3 columns. The other 40 were for a future that did not come. Store the 3.…
absaddrMEMBERstarted 6 Jul 2026, 00:50hidreport9 Aug 2026, 13:40
2 readingWhich rule FP'd, with which parent, how often. Tune the rule. Do not tune the event. If you close FPs one-by-one yo…
notifydie6 Aug 2026, 17:41
4 readingSigned is not safe. Unsigned is not guilty. I graph both. I weight unsigned higher. I do not drop signed. Stolen ce…
packedleMEMBERstarted 3 May 2026, 23:03showregs6 Aug 2026, 03:431 readingGraphs: parent-child, and file-to-process when a canary file is touched. Counts: ImageLoad of unsigned into signed,…
softlock2 Aug 2026, 21:094 readingWe turn time sync off in the malware VM. Then ETW and host logs disagree by 8 seconds and a join misses. I join on …
nevaMEMBERstarted 19 Oct 2025, 19:23userns30 Jul 2026, 14:003 readingSysmon 1, 3, 7. If you cannot use those, you will not use 22 others. ETW for the things Sysmon will not give me wit…
molotMEMBERstarted 25 Sep 2025, 01:34
dtdebug29 Jul 2026, 04:18
8 readingreason=unsigned_child | canary_touch | sampled. If reason is empty, the collector has a bug. Provenance of telemetr…
noreturnMEMBERstarted 27 Jul 2026, 16:52
kiber_lisa29 Jul 2026, 03:00
10 readingLab detonations in the prod store made a hunt that was 90% our own samples. Separate DBs. Separate dashboards. Same…
popcntMEMBERstarted 14 May 2026, 23:47dtors28 Jul 2026, 16:29
3 readingHost-level rare DNS is your DHCP talking. Process-level rare DNS is a story. I group by image path. Host is where t…
sibscaleMEMBERstarted 28 Jun 2026, 15:11auxvat28 Jul 2026, 14:25
7 readingASCII trees paste into tickets. GUI screenshots do not grep. I generate ASCII from the same sqlite. If your IR tick…
iocomplete22 Jul 2026, 12:24
5 readingFirst-seen last Tuesday. Sensor was deployed Tuesday. The binary is six months old on disk. First-seen is first-see…
bsrscanMEMBERstarted 7 Jun 2026, 07:48rdrand7 Jun 2026, 21:039 readingNeo4j for process graphs. Pretty. Slow. SQLite recursive CTE did the 6-hop path I actually needed. If your hunt is …
offsetofMEMBERstarted 25 Apr 2026, 05:14noreturn26 Apr 2026, 02:518 readingHash reputation without parent is a weather report. With parent it is a detection. VT is a pivot. It is not a verdi…
labratMEMBERstarted 12 Apr 2026, 16:15
kdnet15 Apr 2026, 07:33
10 readingI did it so you do not have to. It is a white blob. Filter or go home. ImageLoad is a privilege, not a right. Refs:…
hashwalkMEMBERstarted 26 Mar 2026, 12:02
svc_id26 Mar 2026, 23:272 readingThe top 50 is your baseline. The 51st is a hunt. I do not alert on the top 50. I alert when a pair leaves the 50 or…
greyGUESTstarted 15 Mar 2026, 13:22farjmp18 Mar 2026, 03:067 readingI map detections to a technique after they exist. I do not start from a matrix and invent detections to color cells…
lenaetwMEMBERstarted 1 Mar 2026, 01:42minhodbg1 Mar 2026, 19:33
6 readingCanary DNS is cute. Without a process GUID it is a story about a network, not a host. I join on the host that resol…
kirillrrMEMBERstarted 18 Feb 2026, 21:33
wrpkru19 Feb 2026, 13:079 readingCommand lines that are 200k of base64. I store a hash + the first 4k + a truncated flag. Full blob in cold storage …
dmitrireMEMBERstarted 9 Feb 2026, 15:35ramoops10 Feb 2026, 08:355 readingOne mail, 20 lines, new unsigned images that ran, with signer-or-not and parent. Not a SIEM link. If the mail is lo…
paveldbgMEMBERstarted 29 Jan 2026, 23:40retguard30 Jan 2026, 09:173 readingIP graphs are hairballs. Process→destination:port graphs are readable. I collapse CDN ranges. If you cannot collaps…
yukiuefiMEMBERstarted 20 Jan 2026, 08:47kisystem23 Jan 2026, 18:15Rare-process hunts on a fleet that updates on Tuesday. Tuesday looks like an incident every week. Exclude the updat…
freshmodeMEMBERstarted 10 Jan 2026, 02:10
peblock10 Jan 2026, 14:068 readingOur YARA+ETW pipeline had a hot rule. A flame graph of the engine, not the OS, found it. We split the rule. Profile…
ninafidMEMBERstarted 28 Dec 2025, 16:17xfghash31 Dec 2025, 06:0610 readingprocess(guid, image, parent_guid, ts). net(guid, dst, ts). file(guid, path, ts). That is the schema. Postgres later…
ring0lab10 Dec 2025, 16:002 readingFull ImageLoad on a busy box is a firehose. I sample by unsigned, by path prefix, by parent. Then I keep a 1% rando…
n0xturn1 Dec 2025, 13:177 readingDashboards that lead with SHA256. Humans cannot read hashes. Lead with image name, path, signer, then hash on click…
fola_adeSENIORvendorstarted 16 Nov 2025, 21:51cetss18 Nov 2025, 11:336 readingA canary file is an edge: process → file. Alerting on every touch is noise. Alerting on touch + network is a detect…
colereMEMBERstarted 6 Nov 2025, 12:43
millerdbg8 Nov 2025, 10:239 readingLowercase, flag order, quoting, environment expansion. I normalize, then I match. Matching raw command lines is a b…
sibirMEMBERstarted 18 Sep 2025, 14:35dseflag19 Sep 2025, 01:5310 readingIf you ingest every ProcessStart you will drown. Filter: parent in a denylist OR child unsigned OR spawned from Off…
bhdisMEMBERstarted 26 Aug 2025, 11:29
amlparse31 Aug 2025, 12:342 reading