Skip to main content

#detection

Every article tagged “detection”, newest first.

Articles tagged detection

Four dark glass cubes linked on a faint grid, with one amber pulse travelling between them and an amber glow where it lands

Tutorials

Cybersecurity Home Lab: Build One That Generates Alerts

Build a cybersecurity home lab with Active Directory, Sysmon and a SIEM, then run 5 attacks and check the exact event IDs each one should leave.

Nerea Guallar13 min read
Abstract dark data visualisation of two authentication paths running side by side, one traced in amber, converging on a single log entry

Tutorials

NTLM vs Kerberos: Differences and How to Read Them in Logs

NTLM vs Kerberos side by side, the 4624, 4776 and 4769 fields that show which one ran, why Windows falls back, and SPL and KQL that catch a downgrade.

Nerea Guallar20 min read
Abstract dark diagram of many dim branching paths with one amber route traced unbroken from left to right

Best Practices

SOC Playbook Template: Steps, Queries and Thresholds

Copy this SOC playbook template: triggers, steps, SPL/KQL/Lucene queries and branch thresholds for one alert type, with two filled-in examples.

Nicole Dobrovolskyy23 min read
Abstract dark chart of web request volume where one isolated bar is highlighted and branches into a small process tree

Tutorials

Web Shell Detection: KQL, IIS Logs and a 30-Minute Triage

The process-parent rule that finds web shells, the false positive that gets it muted, IIS log tells in KQL and Splunk, and an ordered first 30 minutes.

Astrid Lindqvist19 min read
Abstract dark illustration of numbered authentication paths converging on a single Windows security log entry

Tutorials

Windows Logon Types: A Triage Guide for Every 4624 Value

Every Windows logon type, what produces it in a healthy environment, what it means when it appears where it should not, and the queries to hunt it.

Astrid Lindqvist17 min read
Abstract dark illustration of a glowing authentication code fracturing into token shards drifting toward a shadowed terminal

Tutorials

Device Code Phishing: How to Detect the MFA Bypass

Device code phishing gives attackers OAuth tokens after the victim passes real MFA. See the Entra sign-in signals that catch it and how to block the flow.

Astrid Lindqvist11 min read
Abstract rows of dark glass slats receding diagonally with a warm orange glow, evoking scrolling log lines

Tutorials

Windows Event Logs: Where They Live and How to Read Them

Windows event logs are .evtx files in C:\Windows\System32\winevt\Logs. Read the channels that matter to a SOC and preserve a copy as evidence.

Astrid Lindqvist20 min read
Dual-monitor workstation in a dark room showing code on an iMac and a landscape wallpaper on a second display, lit by a desk lamp

Best Practices

Best EDR Tools in 2026: What Each Console Shows You

Eight EDR tools compared on what each console shows an analyst, with plan names, public prices checked October 2026, and free and open source options.

Astrid Lindqvist21 min read
Green Matrix-style falling code characters cascading down a pure black background, representing data stream analysis and threat hunting

Best Practices

Threat Hunting Tools: 13 Picks With Working Queries (2026)

Threat hunting tools by layer: Sigma, YARA, KQL, SPL, Velociraptor, Sysmon, Zeek and six more, rechecked October 2026, with working queries.

Astrid Lindqvist28 min read