Detection index

Every detection write-up here, each one run against real lab telemetry. Newsletter issues carry the Newsletter label. Filter by ATT&CK technique, tactic, or query language.

TechniqueTacticQuery language

12 detections

Detection	ATT&CK	Tactic	Query	Platform	Rule format	Published
NewsletterWatch it run: the network scan 45+ ransomware groups use	T1018 T1046	Discovery		Elastic, Defender		Sep 30, 2026
NewsletterScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays	T1219 T1543.003	Command and Control Persistence	KQL, ES\|QL	Elastic, Defender, Sysmon		Sep 23, 2026
Newsletter32 Ransomware Groups Abuse AnyDesk. Your EDR Sees a Legit Tool	T1219 T1543.003	Command and Control Persistence	KQL	Defender		Jul 29, 2026
NewsletterDetecting Reverse SSH SOCKS Tunnels: Separating Benign -R From Akira Pivoting	T1090.002 T1572	Command and Control	KQL, ES\|QL	Elastic, Defender, Sysmon		Jun 17, 2026
NewsletterHunt Ransomware Before It Encrypts: The Three Tools 45+ Gangs Reach For	T1018 T1046	Discovery	KQL, ES\|QL	Elastic, Defender		Jun 6, 2026
wbadmin NTDS.dit dump detection for Domain Controllers	T1003.003			Elastic	Sigma	Jan 3, 2026
How to set up Sigma rules for Elasticsearch SIEM				Elastic	Sigma	Nov 23, 2025
Discovery using nltest, net and whoami	T1016 T1033 T1087.001 T1087.002 T1482		KQL	Elastic	Sigma	Oct 2, 2025
LSASS Dump via comsvcs.dll: Defender Detection Guide	T1003.001 T1027.010 T1036 T1057		KQL	Elastic	Sigma	Sep 25, 2025
Qealler Infostealer static analysis – Part 0x1	T1555.003					Jan 6, 2020
UAC bypass analysis (Stage 1) Ataware Ransomware – Part 0x2	T1548.002 T1218.003 T1218			Sysmon		May 7, 2019
Excel 4.0 Macro, hta, VBScript & PowerShell Analysis Ataware Ransomware – Part 0x1	T1059.001 T1218.005					Apr 30, 2019

New detections ship in the newsletter first. This page is the permanent record.

Detection index

Get the next detection in your inbox