Detection engineering

Projects

• Detection engineering

  Custom SIEM + Sentinel BAS

  A Python SIEM paired with an attack-simulation engine that measures whether each detection actually fires.

  • Sigma
  • MITRE ATT&CK
  • Python

  Read case study Validation results by technique Source code on GitHub

• Purple team lab

  Active Directory lab

  An enterprise Active Directory lab for adversary emulation and SOC detection, mapping attack paths to Windows and Sysmon telemetry and MITRE ATT&CK.

  • Active Directory
  • Sysmon
  • MITRE ATT&CK

  Source code on GitHub Read the write-up

• Security engineering

  ARGUS

  16 MITRE ATT&CK-tagged threat detectors watch the Windows machine ARGUS runs on.

  • Python
  • Local AI
  • Windows

  How ARGUS detects threats Read case study

Write-ups

• August 20265 min read

  Full Kill Chain: From an LLMNR Broadcast to Domain Admin in My Own Active Directory Lab

  Nine attack phases, nine matching detections — red team and blue team, same person, same lab.

  • active directory
  • blue team
  • windows server
  • cybersecurity
  • red teaming

  Read the write-up

• August 20263 min read

  Building a Detection Validation Engine — and Finding Out My Detection Rule Couldn’t Physically Fire

  Somewhere in building a SIEM and an Active Directory attack lab separately, I kept hitting the same annoying question: how do I actually know a detection rule works?

  • blue team
  • cybersecurity
  • threat detection
  • atomic red team
  • red team

  Read the write-up

• August 20264 min read

  I Built My Own SIEM From Scratch. Here’s What Broke, and What I Learned Fixing It.

  Not another “top 10 SIEM tools” listicle — the actual debugging notes from building one.

  • software engineering
  • blue team
  • cybersecurity
  • siem
  • red team

  Read the write-up

Sigma rules

Three of the rules from my SIEM, each mapped to the ATT&CK technique it detects. The full set is on GitHub.

• Credential Dumping Tool ExecutionT1003 OS Credential DumpingCritical
• Encoded PowerShell Command ExecutionT1059.001 Command and Scripting Interpreter: PowerShellHigh
• Suspicious Access to Administrative ShareT1570 Lateral Tool TransferMedium

Read the detection logic All rules on GitHub

Techniques and tools

Sigma

The vendor-neutral format the SIEM’s detection rules are written in.

MITRE ATT&CK

Every rule and detector is tagged with the technique it detects, so coverage can be counted technique by technique.

Atomic Red Team

The attack techniques Sentinel BAS runs against the SIEM to check that each detection fires.

Sysmon

Windows telemetry from the Active Directory lab, where each attack path is mapped to what it leaves in the logs.

Attack-chain correlation

The SIEM links related alerts within a 60-minute window into a single chain.