/en/categories/detections/Recent content in Detections on Suspicious BytesHugoen-USMon, 08 Jun 2026 00:00:00 +0000/en/posts/writing-your-first-sigma-rule/Mon, 08 Jun 2026 00:00:00 +0000/en/posts/writing-your-first-sigma-rule/<p>Sigma is to log detections what YARA is to files: a generic, vendor-neutral way to describe <em>what</em> you want to detect, which you then convert into the query language your SIEM actually speaks.</p> <h2 id="why-a-portable-format">Why a portable format?</h2> <p>Detections written directly in one query language are stuck there forever. Sigma lets you write once and compile to many backends:</p> <ul> <li>One rule, many targets (Splunk, Elastic, Sentinel, …)</li> <li>Reviewable in pull requests like any other code</li> <li>Shareable with the community without leaking your stack</li> </ul> <blockquote> <p>A detection you cannot test, version, and review is a liability, not an asset.</p>/en/posts/detecting-lateral-movement/Sat, 30 May 2026 00:00:00 +0000/en/posts/detecting-lateral-movement/<p>Once an attacker has a foothold, the interesting part begins: moving from the first host toward whatever they actually came for. That east-west movement leaves traces if you know which events to join.</p> <h2 id="signals-worth-joining">Signals worth joining</h2> <p>Lateral movement rarely shows up as a single smoking-gun event. It emerges from correlation:</p> <ol> <li>Network logon events (<code>4624</code> type 3) from unusual sources</li> <li>Service or scheduled-task creation on the destination</li> <li>Remote process creation shortly after</li> </ol> <blockquote> <p>Correlate across hosts, not just within one. A single <code>4624</code> is noise; a chain of them following an account around the estate is a story.</p>