Back to learning pathsDetection & Threat Hunting
Build a baseline. Follow a hypothesis. Turn suspicious behavior into a tested detection.
Master the process of turning raw endpoint and network telemetry into reliable, resilient detection logic that catches attacker behavior rather than transient indicators.
Intended goal
Gain the confidence to inspect enterprise telemetry baselines, write robust Sigma rules for novel attacker techniques, and validate them against real event logs.
Suggested baseline skills
Basic understanding of Windows Event Logs (Event IDs 4688, 4624, 4672, 7045)- Sysmon process creation, network connection, and image load telemetry
- Familiarity with query syntax (KQL, Lucene, or SQL-like searches)
Learning progression
Understand Normal Telemetry Baselines
Identify typical administrative scripting, scheduled tasks, and network traffic to separate normal operational noise from true anomaly.
Deconstruct Adversary Execution
Examine LOLBAS execution, process injection, and parent-child process anomalies in controlled attack scenarios.
Draft and Test Sigma Detection Logic
Write detection rules focused on behavior, test them against positive and negative telemetry sets, and minimize false positives.
Continuous Validation with AI Assistance
Use AI to draft test queries and syntax variations, then rigorously validate every condition against observable event logs.
Your first resource
Begin with this free, practical session before advancing through the sequence.
CTI 101: Intelligence into Action
35 min
Blue vs. Red with AI
From Attacker Playbooks to Defender Detections: the flagship curriculum that goes deep in this area.
