#detectionengineering — Public Fediverse posts

New by me: CybersecKyle Security How-To Series: Blue Team Fundamentals, Part 6 - SIEM-Lite with a Few Useful Alerts

https://www.kylereddoch.me/blog/cyberseckyle-security-how-to-series-blue-team-fundamentals-part-6-siem-lite-with-a-few-useful-alerts/

#Cybersecurity #InfoSec #SIEM #DetectionEngineering #CybersecKyleHowTo

New by me: CybersecKyle Security How-To Series: Blue Team Fundamentals, Part 6 - SIEM-Lite with a Few Useful Alerts

https://www.kylereddoch.me/blog/cyberseckyle-security-how-to-series-blue-team-fundamentals-part-6-siem-lite-with-a-few-useful-alerts/

#Cybersecurity #InfoSec #SIEM #DetectionEngineering #CybersecKyleHowTo

🛡️ Antiphishing is now officially available in @opnsense.org (@suricata IDPS)

OPNsense 26.7.2, released today, includes:

`os-intrusion-detection-content-at-antiphishing 1.0`

The plugin integrates the Antiphishing Suricata ruleset into the OPNsense ecosystem.

This is another step toward making community-driven Threat Intelligence directly consumable at the network enforcement layer.

Current ecosystem integration:

• Suricata / suricata-update
• OPNsense
• pfSense PR in progress

The project also recently added NRD-based threat intelligence for proactive phishing infrastructure detection (Suspect domains).

📖 OPNsense Quick Guide

For users who want to enable the ruleset on OPNsense 26.7.2:

Quick Guide — Installing Antiphishing on OPNsense 26.7.2

Project:
https://github.com/julioliraup/Antiphishing

Vector / CTI dashboard:
https://julioliraup.github.io/AT/

#Suricata #OPNsense #ThreatIntelligence #CTI #DetectionEngineering #IDS #IPS #OpenSource

🛡️ Antiphishing is now officially available in @opnsense.org (@suricata IDPS)

OPNsense 26.7.2, released today, includes:

`os-intrusion-detection-content-at-antiphishing 1.0`

The plugin integrates the Antiphishing Suricata ruleset into the OPNsense ecosystem.

This is another step toward making community-driven Threat Intelligence directly consumable at the network enforcement layer.

Current ecosystem integration:

• Suricata / suricata-update
• OPNsense
• pfSense PR in progress

The project also recently added NRD-based threat intelligence for proactive phishing infrastructure detection (Suspect domains).

📖 OPNsense Quick Guide

For users who want to enable the ruleset on OPNsense 26.7.2:

Quick Guide — Installing Antiphishing on OPNsense 26.7.2

Project:
https://github.com/julioliraup/Antiphishing

Vector / CTI dashboard:
https://julioliraup.github.io/AT/

#Suricata #OPNsense #ThreatIntelligence #CTI #DetectionEngineering #IDS #IPS #OpenSource

Antiphishing Detection Update

A new threat intelligence cycle has been processed by the Antiphishing pipeline.

Current detection coverage:

• 6,007,331 HTTP signatures
• 243,098 TLS signatures
• 243,098 DNS signatures
• 6,493,527 total generated signatures

The pipeline transforms phishing indicators from community intelligence sources into Suricata detection signatures across DNS, TLS and HTTP.

The ruleset is available through the suricata-update ecosystem.

Detection is only useful when intelligence can reach the enforcement layer.

Feeds → IOC processing → Rule generation → Suricata → Detection

Run julioliraup/Antiphishing on @suricata
https://github.com/julioliraup/Antiphishing
#Suricata #ThreatIntelligence #DetectionEngineering #Phishing #OpenSource #CyberSecurity

Antiphishing Detection Update

A new threat intelligence cycle has been processed by the Antiphishing pipeline.

Current detection coverage:

• 6,007,331 HTTP signatures
• 243,098 TLS signatures
• 243,098 DNS signatures
• 6,493,527 total generated signatures

The pipeline transforms phishing indicators from community intelligence sources into Suricata detection signatures across DNS, TLS and HTTP.

The ruleset is available through the suricata-update ecosystem.

Detection is only useful when intelligence can reach the enforcement layer.

Feeds → IOC processing → Rule generation → Suricata → Detection

Run julioliraup/Antiphishing on @suricata
https://github.com/julioliraup/Antiphishing
#Suricata #ThreatIntelligence #DetectionEngineering #Phishing #OpenSource #CyberSecurity

📢 Come join us in Atlanta, GA November 13-14 at Monday Night Brewing - The Grove, for #DEATHCon 2026 on-site! 📢

We'll have a ton of excellent workshops and interesting environments to explore, focusing on #threathunting and #detectionengineering! 🔍 🏹

Meet fellow practitioners, learn something new, and enjoy some great food and beverages in a relaxed, friendly setting! 🤝 🥪

https://www.simpletix.com/e/deathcon-atlanta-2026-tickets-280161

📢 Come join us in Atlanta, GA November 13-14 at Monday Night Brewing - The Grove, for #DEATHCon 2026 on-site! 📢

We'll have a ton of excellent workshops and interesting environments to explore, focusing on #threathunting and #detectionengineering! 🔍 🏹

Meet fellow practitioners, learn something new, and enjoy some great food and beverages in a relaxed, friendly setting! 🤝 🥪

https://www.simpletix.com/e/deathcon-atlanta-2026-tickets-280161

Friendly reminder that the first round of DEATHCon tickets go on sale July 7th. I recommend setting a reminder and logging on earlier in the day (like, early morning) to purchase as they will sell out quick.

DEATHCon is easily the best bang for your conference buck when it comes to the amount of presentations and available logs to cut your teeth on detection engineering and threat hunting.

https://deathcon.io/tickets.html

#deathcon #threathunting #detectionengineering #conference

Network defenders should take a look at and hunt for Overlord RAT, a publicly-available and open-source Go-based RAT. Proofpoint recently published a blog post highlighting its adoption by UNK_DeadDrop, a DPRK-nexus threat group which appears to have used a lightly modified version but can still be detected via Shodan, Censys, or FOFA queries. Proofpoint notes minor operational overlaps with Contagious Interview, but UNK_DeadDrop appears to prefer Overlord while Contagious Interview sticks with OtterCookie/InvisibleFerret. Regardless, extraction of TTPs is super easy when the source code is available and great for folks who want an introduction into detection engineering and/or threat hunting.

For example, Overlord RAT ships with default self-signed certificates/port configurations. While advanced adversaries will obviously alter these settings, many groups won’t, including UNK_DeadDrop. This makes developing a baseline detection within Censys/Shodan/FOFA trivial for monitoring. The Censys query in the screenshot is rudimentary, but you get the idea. Start with low-hanging fruit and tune your queries to hunt for advanced adversaries who might be using more bespoke Overlord configurations. Once found, ingest and retro-hunt the IOCs in your environment. Overlord clients will establish C2 communications with these servers.

https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal
https://github.com/vxaboveground/Overlord

#overlord #unk_deaddrop #RAT #detectionengineering #threathunting #cti #threatintel

New post: Detecting Misuse with the Claude Compliance API 🔍

Mapping the Compliance API feed to your SIEM gets you IAM and access detections “for free”, but the real AI threats live in the message content: prompt injection, jailbreaks, exfiltration prep, shadow data flow.

So I built a prefilter → LLM judge → SIEM pipeline to catch them, with a working repo + Sigma rules to run offline.

https://www.papermtn.co.uk/detecting-misuse-with-the-claude-compliance-api-the-threat-is-in-the-content/

#infosec #DetectionEngineering #LLMSecurity #AI #blueteam

New post: Detecting Misuse with the Claude Compliance API 🔍

Mapping the Compliance API feed to your SIEM gets you IAM and access detections “for free”, but the real AI threats live in the message content: prompt injection, jailbreaks, exfiltration prep, shadow data flow.

So I built a prefilter → LLM judge → SIEM pipeline to catch them, with a working repo + Sigma rules to run offline.

https://www.papermtn.co.uk/detecting-misuse-with-the-claude-compliance-api-the-threat-is-in-the-content/

#infosec #DetectionEngineering #LLMSecurity #AI #blueteam

[DxBP] Part 1 - Technical Detection Engineering Best Practices

https://kqlquery.com/posts/dxbp-part1/

Read on HackerWorkspace: https://hackerworkspace.com/article/dxbp-part-1-technical-detection-engineering-best-practices

#incidentresponse #threatintelligence #detectionengineering

[DxBP] Part 1 - Technical Detection Engineering Best Practices

https://kqlquery.com/posts/dxbp-part1/

Read on HackerWorkspace: https://hackerworkspace.com/article/dxbp-part-1-technical-detection-engineering-best-practices

#incidentresponse #threatintelligence #detectionengineering

Detection engineers aren't being displaced by autonomous SOC capabilities. They're being asked to shift perspective
.
Not: does this rule fire correctly?
But: which signals are trustworthy enough for the system to act on without me? What confidence threshold separates automatic containment from escalation?

Same deep attacker expertise. Applied to a new layer of decisions.

gethumming.io
#ITDR #SecurityOps #DetectionEngineering #CyberSecurity

DEATHCon CFP open until June. Great conference with great content.

https://deathcon.io/cfp.html

#deathcon #cfp #threathunting #detectionengineering

DEATHCon CFP open until June. Great conference with great content.

https://deathcon.io/cfp.html

#deathcon #cfp #threathunting #detectionengineering

Has anyone been able to successfully replicate copying and pasting ClickFix/TerminalFix/*Fix commands into macOS Terminal to trigger this new-fangled malware warning? I have attempted numerous commands, from base64-encoded content to osascripts mimicking macOS infostealer prompts to cURL commands downloading remote content. I even replicated the command documented in the Toms Guide article using the same tool in the same browser and it ran flawlessly in Terminal with no popup. And yes, I’m running Tahoe 26.4 on an M3. I’d like to think this would be a useful ‘stop-and-think’ mitigation but I can’t even consistently trigger it. And, per usual, Apple is tight-lipped on HOW they are detecting malicious commands so it’s likely to remain a black box mitigation. And yeah, I get it, the end user can just click right through the warning via a sneaky social engineering prompt. My goal was to try and build out detection logic to ID when a user gets hit with a prompt so I can at least investigate what the user tried to do and dig deeper into the threat. Since theoretically the user won’t run the command, it won’t get logged in SIEM/EDR tools. I need to rely on other mechanisms for detecting the paste event.

https://www.tomsguide.com/computing/online-security/i-tried-apples-new-security-feature-in-macos-that-warns-you-about-potential-clickfix-attacks-and-windows-should-take-note?utm_source=flipboard&utm_medium=activitypub

#macos #clickfix #terminalfix #threatintel #pastejacking #detectionengineering #threathunting

CVE-2026-21902 represents a high-impact infrastructure exposure.

Affected platform: Junos OS Evolved on PTX series routers.

Attack vector: Unauthenticated network access.
Privilege level: Root execution.
Service: On-Box Anomaly Detection, enabled by default.

Strategic risk:
• Traffic interception capability
• Policy manipulation
• Controller redirection
• Lateral pivoting
• Long-term foothold persistence
Although no exploitation has been observed, historically, high-performance routing infrastructure is a prime target due to its control-plane visibility and network centrality.

Recommended actions:
– Immediate patch validation
– Control-plane traffic monitoring
– Service exposure review
– Network segmentation validation
– Threat hunting for anomalous routing behavior
Are infrastructure devices integrated into your continuous detection engineering pipeline?

Source: https://www.securityweek.com/juniper-networks-ptx-routers-affected-by-critical-vulnerability/

Engage below.
Follow TechNadu for high-signal vulnerability intelligence.
Repost to strengthen security awareness.

#Infosec #CVE2026 #Juniper #RouterSecurity #CriticalInfrastructure #ThreatModeling #DetectionEngineering #NetworkDefense #ZeroTrustArchitecture #CyberRisk #SecurityOperations #VulnerabilityManagement

APT37’s Ruby Jumper campaign demonstrates a mature approach to air-gap traversal.

Observed tradecraft includes:
• LNK-based initial execution
• Embedded PowerShell payload extraction
• Ruby interpreter abuse (v3.3.0)
• Scheduled task persistence (5-minute interval)
• USB-based covert bidirectional C2
• Multi-stage backdoor deployment
Toolset: RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE, BLUELIGHT.

The removable media relay model enables:
– Command staging offline
– Data exfiltration without internet access
– Lateral spread across isolated systems
– Surveillance via Windows spyware
This reinforces a critical point:
Air-gap controls must extend beyond physical disconnection — including USB governance, device auditing, behavioral monitoring, and strict runtime execution policies.

Are critical infrastructure operators prepared for USB-mediated C2 relays?

Source: https://www.bleepingcomputer.com/news/security/apt37-hackers-use-new-malware-to-breach-air-gapped-networks/

Engage below.

Follow TechNadu for high-signal threat intelligence insights.
Repost to elevate awareness.

#Infosec #APT37 #AirGapSecurity #ThreatModeling #MalwareAnalysis #NationStateThreats #USBExfiltration #SOC #DetectionEngineering #CyberDefense #OperationalSecurity #ThreatHunting #ZeroTrustArchitecture

APT37’s Ruby Jumper campaign demonstrates a mature approach to air-gap traversal.

Observed tradecraft includes:
• LNK-based initial execution
• Embedded PowerShell payload extraction
• Ruby interpreter abuse (v3.3.0)
• Scheduled task persistence (5-minute interval)
• USB-based covert bidirectional C2
• Multi-stage backdoor deployment
Toolset: RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE, BLUELIGHT.

The removable media relay model enables:
– Command staging offline
– Data exfiltration without internet access
– Lateral spread across isolated systems
– Surveillance via Windows spyware
This reinforces a critical point:
Air-gap controls must extend beyond physical disconnection — including USB governance, device auditing, behavioral monitoring, and strict runtime execution policies.

Are critical infrastructure operators prepared for USB-mediated C2 relays?

Source: https://www.bleepingcomputer.com/news/security/apt37-hackers-use-new-malware-to-breach-air-gapped-networks/

Engage below.

Follow TechNadu for high-signal threat intelligence insights.
Repost to elevate awareness.

#Infosec #APT37 #AirGapSecurity #ThreatModeling #MalwareAnalysis #NationStateThreats #USBExfiltration #SOC #DetectionEngineering #CyberDefense #OperationalSecurity #ThreatHunting #ZeroTrustArchitecture

We’re looking for a Detection Engineer to build and maintain detection rules using the detection-as-code principle (with Sigma!). If you’re into turning threat intelligence data into actionable alerts, we want to hear from you! 🚀

#detectionengineering

https://www.cert.europa.eu/vacancies/it-security-officer-detection-engineer

🏋️ 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟲 𝗙𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻𝘀/𝗧𝗿𝗮𝗶𝗻𝗶𝗻𝗴𝘀 (9/12): "Advanced Detection Engineering in the Enterprise" 𝗽𝗮𝗿/𝗯𝘆 Olaf Hartong & Rogier Boon (FalconForce)

📅 Dates: May 11, 12 and 13, 2026 (3 days)
📊 Difficulty: Medium
🖥️ Mode: On-Site

Description: "𝘍𝘢𝘭𝘤𝘰𝘯𝘍𝘰𝘳𝘤𝘦 𝘥𝘦𝘷𝘦𝘭𝘰𝘱𝘦𝘥 𝘢 𝘴𝘱𝘦𝘤𝘪𝘢𝘭𝘪𝘴𝘵 𝘸𝘰𝘳𝘬𝘴𝘩𝘰𝘱 𝘧𝘰𝘳 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘱𝘳𝘰𝘧𝘦𝘴𝘴𝘪𝘰𝘯𝘢𝘭𝘴 𝘵𝘰 𝘩𝘦𝘭𝘱 𝘵𝘢𝘬𝘪𝘯𝘨 𝘵𝘩𝘦𝘪𝘳 𝘥𝘦𝘵𝘦𝘤𝘵𝘪𝘰𝘯 𝘦𝘯𝘨𝘪𝘯𝘦𝘦𝘳𝘪𝘯𝘨 𝘤𝘢𝘱𝘢𝘣𝘪𝘭𝘪𝘵𝘪𝘦𝘴 𝘵𝘰 𝘵𝘩𝘦 𝘯𝘦𝘹𝘵 𝘭𝘦𝘷𝘦𝘭. 𝘈𝘯 𝘶𝘭𝘵𝘪𝘮𝘢𝘵𝘦 𝘥𝘦𝘵𝘦𝘤𝘵𝘪𝘰𝘯 𝘦𝘯𝘨𝘪𝘯𝘦𝘦𝘳𝘪𝘯𝘨 𝘭𝘦𝘢𝘳𝘯𝘪𝘯𝘨 𝘦𝘹𝘱𝘦𝘳𝘪𝘦𝘯𝘤𝘦 𝘸𝘪𝘵𝘩 𝘵𝘩𝘦 𝘰𝘱𝘱𝘰𝘳𝘵𝘶𝘯𝘪𝘵𝘺 𝘵𝘰 𝘨𝘰 𝘢𝘭𝘭-𝘪𝘯 𝘸𝘪𝘵𝘩 𝘳𝘦𝘢𝘭-𝘭𝘪𝘧𝘦, 𝘩𝘢𝘯𝘥𝘴-𝘰𝘯 𝘭𝘢𝘣 𝘦𝘹𝘦𝘳𝘤𝘪𝘴𝘦𝘴. 𝘛𝘩𝘦 𝘵𝘳𝘢𝘪𝘯𝘪𝘯𝘨 𝘤𝘰𝘷𝘦𝘳𝘴 𝘢 𝘧𝘶𝘭𝘭, 𝘳𝘦𝘢𝘭𝘪𝘴𝘵𝘪𝘤 𝘢𝘵𝘵𝘢𝘤𝘬𝘦𝘳 𝘴𝘤𝘦𝘯𝘢𝘳𝘪𝘰 𝘪𝘯 𝘢𝘯 𝘦𝘯𝘵𝘦𝘳𝘱𝘳𝘪𝘴𝘦 𝘦𝘯𝘷𝘪𝘳𝘰𝘯𝘮𝘦𝘯𝘵: 𝘧𝘳𝘰𝘮 𝘵𝘩𝘦 𝘦𝘯𝘥𝘱𝘰𝘪𝘯𝘵, 𝘵𝘩𝘳𝘰𝘶𝘨𝘩 𝘵𝘩𝘦 𝘈𝘤𝘵𝘪𝘷𝘦 𝘋𝘪𝘳𝘦𝘤𝘵𝘰𝘳𝘺 𝘢𝘯𝘥 𝘪𝘯𝘵𝘰 𝘵𝘩𝘦 𝘤𝘭𝘰𝘶𝘥 𝘦𝘯𝘷𝘪𝘳𝘰𝘯𝘮𝘦𝘯𝘵.

𝘛𝘩𝘪𝘴 𝘵𝘳𝘢𝘪𝘯𝘪𝘯𝘨 𝘪𝘴 𝘭𝘦𝘥 𝘣𝘺 𝘦𝘹𝘱𝘦𝘳𝘪𝘦𝘯𝘤𝘦𝘥 𝘪𝘯𝘴𝘵𝘳𝘶𝘤𝘵𝘰𝘳𝘴 𝘵𝘩𝘢𝘵 𝘵𝘦𝘢𝘤𝘩 𝘴𝘵𝘶𝘥𝘦𝘯𝘵𝘴 𝘵𝘰:
𝘜𝘯𝘥𝘦𝘳𝘴𝘵𝘢𝘯𝘥 𝘩𝘰𝘸 𝘵𝘰 𝘳𝘦𝘴𝘦𝘢𝘳𝘤𝘩 𝘢𝘯 𝘢𝘵𝘵𝘢𝘤𝘬𝘦𝘳 𝘵𝘦𝘤𝘩𝘯𝘪𝘲𝘶𝘦 𝘶𝘴𝘦𝘥 𝘪𝘯 𝘤𝘰𝘳𝘱𝘰𝘳𝘢𝘵𝘦 𝘦𝘯𝘷𝘪𝘳𝘰𝘯𝘮𝘦𝘯𝘵𝘴. 𝘉𝘶𝘪𝘭𝘥 𝘳𝘦𝘴𝘪𝘭𝘪𝘦𝘯𝘵 𝘥𝘦𝘵𝘦𝘤𝘵𝘪𝘰𝘯𝘴 𝘵𝘩𝘢𝘵 𝘢𝘳𝘦 𝘩𝘢𝘳𝘥𝘦𝘳 𝘵𝘰 𝘦𝘷𝘢𝘥𝘦 𝘣𝘺 𝘢𝘯 𝘢𝘵𝘵𝘢𝘤𝘬𝘦𝘳. 𝘝𝘢𝘭𝘪𝘥𝘢𝘵𝘦 𝘵𝘩𝘦𝘪𝘳 𝘥𝘦𝘵𝘦𝘤𝘵𝘪𝘰𝘯𝘴 𝘵𝘰 𝘮𝘢𝘬𝘦 𝘴𝘶𝘳𝘦 𝘵𝘩𝘦𝘺 𝘬𝘦𝘦𝘱 𝘧𝘶𝘯𝘤𝘵𝘪𝘰𝘯𝘪𝘯𝘨 𝘢𝘴 𝘪𝘯𝘵𝘦𝘯𝘥𝘦𝘥. 𝘛𝘩𝘦 𝘵𝘳𝘢𝘪𝘯𝘪𝘯𝘨 𝘧𝘰𝘤𝘶𝘴𝘦𝘴 𝘰𝘯 𝘔𝘪𝘤𝘳𝘰𝘴𝘰𝘧𝘵 𝘚𝘦𝘯𝘵𝘪𝘯𝘦𝘭 𝘢𝘯𝘥 𝘋𝘦𝘧𝘦𝘯𝘥𝘦𝘳 𝘟𝘋𝘙, 𝘣𝘶𝘵 𝘤𝘰𝘯𝘤𝘦𝘱𝘵𝘴 𝘤𝘢𝘯 𝘣𝘦 𝘢𝘱𝘱𝘭𝘪𝘦𝘥 𝘵𝘰 𝘰𝘵𝘩𝘦𝘳 𝘴𝘵𝘢𝘤𝘬𝘴 𝘢𝘴 𝘸𝘦𝘭𝘭."

About the trainers:
Olaf Hartong has a vast experience in digital security, specialized in security operations, detection engineering and threat hunting. Olaf has extensive knowledge of different monitoring platforms, in particular the Microsoft Defender XDR and Sentinel stack. He presents on well-known security conferences, such as BlackHat, Defcon, WWHF, BRUcon, SOcon, NorthSec, Insomni'hack and MITRE ATT&CKcon. Olaf is the author of ThreatHunting for Splunk, ATTACK datamap, FalconHound, and Sysmon-modular tools.

Rogier Boon has over 20 years experience as both a security consultant and in-house technical specialist. Throughout his career, Rogier had roles as offensive specialist and blue teamer (TIER2/3 SOC, incident response, detection engineer). Rogier brings extensive experience working in various high-tech environments and researching a multitude of technologies. Rogier facilitated at Black Hat US and various private trainings sessions for in-house SOC teams.

🔗 Save Your Spot: https://nsec.io/training/2026-advanced-detection-engineering-in-the-enterprise/

#NorthSec #cybersecurity #detectionengineering #infosec #blueeteam