Detections are only useful if they survive contact with a real adversary. This is an ongoing library of detection-engineering write-ups that start from attacker behaviour and work backwards to the telemetry and logic that would actually catch it.
Every piece is mapped to MITRE ATT&CK so defenders can see which techniques are covered and, just as importantly, which gaps remain.
The approach
Most detection content starts from a product and lists what it can alert on. This library inverts that. Each write-up begins with how an attack actually unfolds — what the adversary needs to achieve, in what order, and what traces each step unavoidably leaves — and only then asks which log source captures it and what logic separates it from normal activity.
Working that direction exposes something vendor-led content usually hides: the difference between behaviour that is hard to avoid emitting and behaviour that is merely commonly observed. Detections built on the former survive an attacker changing tooling; detections built on the latter break the moment someone swaps a binary or renames a service.
What each write-up covers
- The attack chain in practical terms, stage by stage.
- The specific ATT&CK techniques involved, so coverage can be tracked.
- Which telemetry actually reveals each stage, and where it is commonly missing.
- Detection logic, plus an honest assessment of what will generate false positives and why.
- What the technique looks like after the fact, for incident responders arriving late.
In the library
- Anatomy of a ransomware attack — the full chain from initial access through to encryption, and the points where it is still interruptible.
- Identity is the new perimeter — detecting account takeover when the attacker holds valid credentials and triggers no malware alert.
- Static malware triage — assessing a suspicious file safely without detonating it.
- Mapping your defences to MITRE ATT&CK — turning a framework into an actual coverage assessment rather than a wall chart.
- Reading email headers and anatomy of a phishing URL — the forensic fundamentals behind most initial-access investigations.
Tooling
Several write-ups pair with tools on this site so the techniques can be practised immediately: the email header parser for authentication tracing, the URL scanner for phishing structure, and the hash analyzer for triage.
Read the full series in the research feed.