Rocking the Christmas vibes with some #KQL ❤️

#DFIR and #ThreatHunting friends - the technical detail in this blog is pure gold for hunting and writing detections - even if you don't count TA397 high in your threat model, the techniques they use are not unique and the detections still apply: www.proofpoint.com/us/blog/thre...

Join @olafhartong.nl in his journey down the rabbit hole in search of new detection opportunities in the #Zeek telemetry embedded in Microsoft's EDR #MDE! Detection engineering is sometimes hard … 😎 falconforce.nl/detection-en... #detectionengineering #kql #blueteam

www.elastic.co/security-lab... - great read on maturity model for Detection Engineering. #infosec #cybersecurity #cyber #Detection