Loading…

Wrap-up and resources

Key Takeaways

1. Detection engineering: write the rule that catches the attacker: A good rule catches behaviour the attacker cannot easily change, is tested with a simulated attack before it ships, is tuned until analysts trust it, and lives in Git tagged with its ATT&CK technique.
2. Threat hunting and threat intelligence: Hunting assumes the attacker is inside and looks for them with a clear hypothesis, and every hunt ends with a new rule or a closed visibility gap. The higher you climb the Pyramid of Pain from hashes to behaviour, the costlier it is for the attacker to change their ways.
3. Digital forensics and a first look at malware: Collect the most volatile first (memory before disk), record every hand that touched the evidence, work on a hash-verified copy and never the original, and build one timeline from many sources. Examine malware only in an isolated lab, static first and dynamic second, and turn what you find into a YARA rule and a detection rule.

Term	Definition	Part
Detection engineering	Writing, testing and tuning rules that catch attacker behaviour.	1
Sigma	A generic YAML format for detection rules, converted for any SIEM.	1
Sysmon	Microsoft's tool that logs processes and connections in more detail.	1
Threat hunting	A proactive, hypothesis-led search for an attacker who fired no alert.	2
Pyramid of Pain	Indicators ranked by how hard they are for the attacker to change.	2
TLP 2.0	Sharing labels: CLEAR, GREEN, AMBER, AMBER+STRICT and RED.	2
Order of volatility	Collect what vanishes fastest first: memory before disk.	3
Chain of custody	A record of everyone who touched the evidence, when and with which tool.	3
Forensic image	A bit-for-bit copy proven by hash, made through a write blocker.	3

Grouped by type. Start with the official docs for precision, or an article or video for the explanation.