Volver a las rutas de aprendizajeDetection & Threat Hunting
Build a baseline. Follow a hypothesis. Turn suspicious behavior into a tested detection.
Master the process of turning raw endpoint and network telemetry into reliable, resilient detection logic that catches attacker behavior rather than transient indicators.
Objetivo
Gain the confidence to inspect enterprise telemetry baselines, write robust Sigma rules for novel attacker techniques, and validate them against real event logs.
Habilidades base sugeridas
Basic understanding of Windows Event Logs (Event IDs 4688, 4624, 4672, 7045)- Sysmon process creation, network connection, and image load telemetry
- Familiarity with query syntax (KQL, Lucene, or SQL-like searches)
Progresión del aprendizaje
Understand Normal Telemetry Baselines
Identify typical administrative scripting, scheduled tasks, and network traffic to separate normal operational noise from true anomaly.
Deconstruct Adversary Execution
Examine LOLBAS execution, process injection, and parent-child process anomalies in controlled attack scenarios.
Draft and Test Sigma Detection Logic
Write detection rules focused on behavior, test them against positive and negative telemetry sets, and minimize false positives.
Continuous Validation with AI Assistance
Use AI to draft test queries and syntax variations, then rigorously validate every condition against observable event logs.
Tu primer recurso
Comienza con esta sesión gratuita y práctica antes de avanzar en la secuencia.
CTI 101: Intelligence into Action
35 min
Blue vs. Red with AI
From Attacker Playbooks to Defender Detections: el plan de estudios insignia que profundiza en esta área.
