Building a Phishing Detection Automation: From Unfinished Business to 45-Second Analysis
Sometimes things don t go according to your plan. But sometimes, it just checks whether you have the potential or not.
Detection Desk
Threat detection analysis and hunting walkthroughs from a SOC analyst building in public. Real datasets, real SPL, real findings.
Latest posts
Zero-Touch Security: The 45-Second Automated Phishing Triage Pipeline
Moving Threat Triage Upstream to Prevent Enterprise Data Exfiltration
CISA KEV Threat Intel Orchestrator: Community Milestones and Project Growth
When I built the CISA KEV Threat Intel Orchestrator, my primary goal was to solve a very specific, practical problem in security operations
Episode 2: The PowerShell Detection Gap (And How We Fix It)
49% of modern cyberattacks use PowerShell, yet attackers hide for almost a year. Here is how we used 196,000 Sysmon events to build a Sigma rule that actually catches fileless malware.
Episode 1: Catching APT29 Staging (Why EventID 1 Isn't Enough)
Most SOC teams only watch process creation. Today, we're tracking what processes load to catch advanced adversaries before they execute.
Advanced Threat Intel: From 6 Hours to 0 Minutes per CVE
How I built a zero-touch pipeline that completely automates CISA KEV tracking and Sigma rule generation.
The plan was to build an AI Phishing detection, but…….
Nothing ever goes as we planned in this accursed world.
Catching APT29 staging malware in 197k+ Sysmon events
The detection rule I built.
DLL Hijacking Still Works in 2026 and Unable to Detect
Why a decades old Windows behavior is powerful tool to APT's
Years of log analysis taught me one thing: context beats volume. I don't hunt EventIDs anymore. I hunt attack sequences
Why experienced threat hunters pivot on process context instead of chasing individual EventIDs
Why Your SIEM Still Can’t Catch PowerShell Attacks (And What I Built To Fix It)
49% of cyberattacks use PowerShell somewhere in the kill chain. Most security teams can't tell when it's being abused.
My First Sigma Detection Rule: LSASS Access
Detects Powershell.exe or cmd.exe accessing lsass.exe with full or near full access rights.
Hunting APT29 Part 4: I Found Hardcoded Credentials in a Single Command Line
Inside The Breach #4
Hunting APT29 Part 3: I Traced the Process Tree Back to the Beginning
Inside The Breach #3
Hunting APT29 Part 2: I Searched One ProcessID. 1,129 Events Came Back.
Inside The Breach #3
Hunting APT29 in 196,071 Logs: What I Found in EventID 1
Inside the Breach #1
WMI Event Consumer Persistence: How APT29 Achieves Fileless Persistence (Part 1)
Understanding the theory before analyzing real attack logs
PowerShell Encoded Commands: Building Detection Rules That Actually Work (Part 2)
I built Splunk queries in my lab.
PowerShell Encoded Commands: Why Attackers Love It and How We Hunt It
They re hiding in plain sight in your logs.
37 Sysmon Events. One Complete DLL Hijacking Attack. Here’s What Happened.
I analyzed real malware logs and discovered why non-admin users can execute code without triggering a single alert.