detection engineering Archives - Page 3 of 3

It’s Not a Bug, It’s Feature Abuse: A Deep Dive Into Azure Web App Logs and Attack Visibility

Azure makes it easy to spin up serverless functions and web apps, a convenience that often comes with security blind spots. Logs are fragmented across services, authentication defaults may leave endpoints exposed, and preview environments

Living off WinRM: Abusing Complexity in Remote Management

Key Context: What Is LOLBAS Anyway? LOLBAS (Living Off The Land Binaries, Scripts, and Libraries) are legitimate Windows tools and binaries that attackers abuse to perform malicious actions without using custom malware. One of the

CardinalOps Solution Brief: Unified Exposure Management

CardinalOps helps enterprise security teams proactively eliminate exposure risk by continuously validating threat coverage, pinpointing exposures that attackers can actually exploit, and enabling high-impact remediations.

MCP Defaults Will Betray You: The Hidden Dangers of Remote Deployment

The Model Context Protocol (MCP) enables seamless integration between large language models (LLMs) and external tools. It powers agent-driven workflows in platforms like Claude Desktop and GitHub Copilot. Typically, developers use MCP servers to expose

AI’s Role in Operationalizing Threat Intelligence

Is the “intelligence” in Threat Intelligence actually a misnomer? Intelligence implies analyzing and interpreting raw, unprocessed information to make decisions and solve problems. Information becomes intelligence when it’s actionable. That’s the missing gap with most

Detection for CTEM: When One Good Detection Is Worth Dozens of Patches

IT and security teams have been pushed for years: just patch faster. Automate remediation. Chip away at that vulnerability backlog (and do it quickly). But speed isn’t the only problem, context matters too. It’s critical

Detection Pitfalls You Might Be Sleeping On

Detection engineering isn’t just about finding bad behavior. It’s about understanding how attackers appear normal—on accident or by design. Some of the most successful evasion techniques don’t involve zero-days or encryption. They rely on you writing

Polymorphic AI Malware: A Real-World POC and Detection Walkthrough

What Is Polymorphic AI Malware? Polymorphic AI malware refers to a new class of malicious software. It leverages artificial intelligence models, such as GPT-based language models, to dynamically generate, obfuscate, or modify its own code

Detection Engineering Best Practices for Implementing a Threat-Informed Defense

In this paper, SANS Director of Emerging Security Trends, John Pescatore, compiles data from the recent SANS survey of 267 cybersecurity professionals to determine the state of practice in detection engineering.