detection

Suricata IDS rule authoring for suspicious lateral movement

Detection engineering works best when the rule reflects a behavior you can explain, not just a string that looked scary once. I use Suricata for network patterns that are specific enough to matter operationally. Rule quality is a maintenance problem a

by Kai Nakamura

Threat hunting query ideas mapped to MITRE ATT and CK patterns

I like threat hunting queries that map to observable attacker behavior rather than vague fear. MITRE ATT&CK gives a useful shared language, but the hunt still needs concrete fields, sources, and hypotheses. The best hunt queries are specific enoug

by Kai Nakamura