Threat Detection

Spot compromised O365 and Google mailboxes from audit logs, inbox rules and sign-ins

Catch malicious inbox and forwarding rules that keep attackers reading your mail

Fingerprint ROADtools, AADInternals and AzureHound in Entra Graph logs with KQL

Spot log tampering, timestomping and security tool disabling in endpoint logs

Find DNS exfiltration in Zeek dns.log using entropy, TXT sizes and query volume

Catch fileless in-memory attacks using PowerShell, WMI and reflective DLL injection

Analyze fileless malware built on PowerShell, .NET reflection and LOLBins

Spot forged Kerberos TGTs with odd lifetimes, encryption types and missing accounts

Detect Golden Ticket forgery via RC4 downgrades in Event 4769 and krbtgt anomalies

Flag insider data theft from DLP violations, upload spikes and off-hours file access

Spot insider threat signs like mass downloads, privilege abuse and off-hours access

Score insider threats with UEBA baselines and peer groups in Elasticsearch

Catch Kerberoasting by watching Event 4769 TGS requests for service accounts with SPNs

Spot lateral movement in auth logs, SMB and RDP sessions with Zeek and Velociraptor

Hunt lateral movement with Splunk SPL over WMI, PsExec and RDP abuse

Track SMB transfers, NTLM spraying and remote execution in Zeek logs

Spot abused Windows LOLBins by their command lines and parent-child process chains

Hunt LOLBAS abuse of certutil, regsvr32, mshta and rundll32 with Sysmon and Sigma

Catch malicious scheduled tasks via Sysmon events 1 and 11 and Windows event 4698

Catch Mimikatz by command-line patterns, LSASS access and known module signatures

Analyze suspicious mobile apps for permission abuse, data theft and C2 traffic

Spot unauthorized Modbus writes and malformed frames with ICS-aware IDS

Detect Modbus anomalies in function codes, register ranges and timing with Zeek

Deploy Zeek to log network traffic and script detections for your own threats

Catch Nmap and Masscan scans with Suricata and Snort threshold rules

Catch NTLM relay by correlating Event 4624 IP mismatches and SMB or LDAP signing gaps

Detect stolen OAuth tokens and replayed refresh tokens in Entra ID sign-in logs

Spot pass-the-hash by flagging NTLM logons where Kerberos was expected

Catch Kerberos pass-the-ticket abuse using Splunk and Elastic queries on auth events

Set up Fail2ban filters that ban IPs for port scans and SSH brute force attempts

Spot privilege escalation via token tricks, UAC bypass, unquoted paths and sudo abuse

Spot process hollowing with memory section checks and parent-child anomaly analysis

Detect DLL injection, APC injection and reflective loading with memory forensics

Catch QR code phishing by decoding images in email that bypass link-based filters

Spot ransomware encryption in real time from entropy spikes and mass file writes

Catch ransomware precursors in network traffic with Zeek, Suricata and SIEM correlation

Spot RDP brute force from failed logons in EVTX files using Event IDs 4625 and 4624

Spot service account misuse with interactive logon and lateral movement checks

Find unapproved SaaS use in proxy, DNS and firewall logs with pandas risk scoring

Block spearphishing with gateway impersonation protection, URL rewriting and sandboxing

Spot SQL injection campaigns in ModSecurity, AWS WAF and Cloudflare logs

Detect PLC logic tampering and spoofed sensor readings that hide Stuxnet-style attacks

Flag risky OAuth app consent grants in Entra ID using Graph audit logs

Hunt encoded commands, download cradles and AMSI bypass in PowerShell telemetry

Detect LSASS, SAM and NTDS.dit credential dumping by correlating EDR and Sysmon events

Spot DLL injection, hollowing and APC injection from Sysmon events 1, 7, 8, 10 and 25

Catch UAC bypass via fodhelper and sudo or setuid abuse using Sysmon and Windows logs

Catch WMI event subscription persistence from Sysmon events 19, 20 and 21

Compare threat intelligence platforms on feeds, STIX/TAXII support, automation and cost