tag: Threat-Detection · 5 items
- Engineer — Skip
- SOC/IR — Learn: YARA-X 1.22.0 ships 11 improvements and 9 bugfixes; teams using YARA-X for detection rules should review the changelog and evaluate whether any fixes affect existing rule accuracy.
- Leader — Skip
- Engineer — Learn: Novel approach to deriving identity role profiles from cloud audit logs via behavioral clustering; no patch or config change needed today, but worth evaluating this technique when designing cloud detection pipelines.
- SOC/IR — Plan: The SQL-based detection queries and clustering methodology are worth adapting for SIEM coverage of anomalous cloud identity behavior; schedule time to evaluate and prototype rules against your cloud audit log sources.
- Leader — Skip
- Engineer — Learn: Practical walkthrough on using MS Graph and PowerShell to surface Entra ID risk detections — useful reference if you’re building automated triage or identity monitoring pipelines.
- SOC/IR — Plan: Walk through the MS Graph risk-detection commands shown here and consider incorporating them into your Entra ID hunting runbooks or SIEM enrichment workflows.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: Research shows that widely-cited lateral movement detectors perform significantly differently under standardized evaluation conditions, suggesting published accuracy claims may be overstated; useful context when selecting or tuning graph-based detection tools.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: High-level argument that malware-free attacks now dominate (~79% per CrowdStrike data) reinforces the case for behavioral and identity-based detection layers alongside EDR; no specific TTPs or tooling to act on immediately.
- Leader — Learn: The framing that AI-equipped attackers are outpacing traditional defenses is useful context for board-level discussions about detection investment, but the piece offers no new data beyond vendor-cited statistics.