analyst@soc-hub:~$ detection-intel --mode live
// Hunt Smarter.
Detect Faster.
Respond Better.
Practical detection guides, hunt playbooks, and tool reviews for SOC analysts and detection engineers. Real techniques, real rules, real tradecraft.
117 Articles
99 Detection Guides
15 Hunt Playbooks
45 MITRE Mapped
// Featured Intel
view all → Detection Guide T1210
Detecting CVE-2026-41089 Netlogon RCE Exploitation Attempts
Detection guidance for CVE-2026-41089, the pre-authentication Netlogon stack buffer overflow actively exploited against domain controllers. Covers network-layer Suricata rules, Windows event log indicators, and a full Sigma detection for anomalous NRPC traffic and post-exploitation behaviour.
Detection Guide T1003.001
Detecting LSASS Credential Dumping on Windows
A practical detection guide for identifying Mimikatz, procdump, and other tools targeting LSASS memory. Covers Sysmon events, Windows Security logs, and Sigma rules you can deploy today.
// Recent Entries
view all → 2026-11-15 Hunt Playbook Hunting Turla's Cereal on Exchange: Native Image Cache DLLs, WMI Folder Hijacks and Unsigned Loads (Sigma, KQL, SPL) → 2026-11-14 Hunt Playbook Hunting PHP2Shell on Check Point Gateways: zz*.tpl Webshells, slot_CPconfigdaemon and the Pivot to ESXi (Sigma, KQL) → 2026-11-13 Hunt Playbook Hunting Falcon C2: Browser-Resident Implants, Sideloaded Extensions and the Antino OneDrive Backdoor (Sigma, KQL, SPL) → 2026-11-12 Hunt Playbook Hunting Citrus Ransomware: GPO Deployment, Xray VLESS Tunnels and Certighost Attempts (Sigma and KQL) → 2026-11-11 Hunt Playbook Hunting AhsayCBS Webshells and Post-Exploitation on Backup Servers: Sigma and KQL → 2026-11-06 Detection Guide Detecting Windows Event Log Clearing (T1685.005): Sigma, KQL and SPL Rules →
// intel feed
Stay Current on Detection Engineering
Subscribe to the RSS feed for new detection guides, hunt playbooks, and tool reviews as they're published.