Baseline Analysis

Alert Design

Deciding how a detection turns into an actionable alert: what conditions trigger it, what context it carries, how severe it is, and how it routes to analysts, so that the alert is meaningful and not lost in noise.

Credential Dumping Indicators

The observable signals in logs and telemetry that credential dumping is occurring, such as suspicious access to LSASS memory, use of known dumping tools, or unusual reads of credential stores, that SIEM queries are written to catch.

DNS-Based Detection

Detection techniques that use DNS query data to find threats, spotting lookups of malicious, newly registered, or algorithmically generated domains, beaconing patterns, and DNS tunneling, often written as SIEM queries over DNS logs.

First-Seen Detection

A SIEM detection technique that flags activity occurring for the first time in an environment, a new domain, a never-before-seen process, a first login from a location, since novelty often signals something worth investigating.

Outlier Detection

A hunting and analysis technique that finds data points deviating markedly from the norm, unusual hosts, accounts, or behaviors, on the principle that statistical outliers often warrant investigation as possible threats.

Identity Anomaly Detection

Detecting unusual identity behavior that may signal compromise, such as logins at odd times or locations, impossible travel, or atypical access, by comparing current activity against an established baseline of normal.

Frequency AnalysisStart here

Long Tail Analysis

Detection Coverage

LOLBin Hunting Methodology

Alert Triage Methodology

Lookup Tables