Threat Hunting, Explained: Hypotheses, Telemetry and the Pyramid of Pain
The proactive complement to alerting: hypothesis-driven hunts, Bianco Pyramid of Pain economics, the maturity model, and the detection conversion loop.
Detection Engineering with Sigma: Detections That Survive Vendor Churn
How Sigma turns SIEM detections into portable YAML, how pySigma pipelines compile them to any backend, and how to test rules like code with Atomic Red Team.
Living off the land signed toolshed
No Malware Needed: How Attackers Turn Your Own Admin Tools Against You
PowerShell, WMI, scheduled tasks, certutil: signed by the OS vendor, whitelisted by AV, trusted by EDR. Living-off-the-land attacks drop no malware, so detection cannot hinge on unknown binaries. The shift from artifact blacklists to execution-baseline analytics that actually catches native-tool chains.