Detection Engineering

wbadmin NTDS.dit dump detection for Domain Controllers

January 3, 2026

elasticsearch, ntds, sigma rules, t1003-003, wbadmin

When wbadmin.exe is used to back up NTDS.dit + registry hives, treat it as credential access, not routine IT backup. This post is for Elastic + Sigma + Windows logs and focuses on wbadmin NTDS.dit dump detection you can validate end-to-end in a lab. You will: spot the command, confirm…

How to set up Sigma rules for Elasticsearch SIEM

November 23, 2025

elasticsearch, kibana, siem, sigma, sigma-cli

Got a fresh Sigma release and an Elasticsearch lab, but no clear path from Sigma YAML rules to detection rules in Elasticsearch SIEM? This guide shows how to set up sigma rules for Elasticsearch SIEM so you can turn community content into Elastic Security rules you can actually run. We…

Discovery using nltest, net and whoami

October 2, 2025

elasticsearch, kql, kusto, nltest, sigma rules, t1016, t1033, t1087-001, t1087-002, t1482, whoami

Quick, high-signal ways to enumerate DCs, trusts, and privileged groups in Active Directory plus how to detect them. Overview Why it matters: these commands are common during early recon. What you get: exact commands, sample output, Sigma detections, and in-the-wild cases. Defend: pair command-line telemetry with parent/child process context and…

LSASS Dump via comsvcs.dll: Defender Detection Guide

September 25, 2025

elasticsearch, kql, lsass, sigma rules, t1003-001, t1027-010, t1036, t1057

Attackers dump LSASS with comsvcs.dll to steal credentials; here’s how to spot rundll32 + MiniDump fast and reliably. 🙂 What the technique is Adversaries attempt to access credential stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and…