How to Turn a Joint Cyber Advisory into Hunts and Detections
A repeatable workflow for public sector SOCs to turn NCSC co-sealed advisories into ATT&CK mapped hunts, tested detections and clear evidence for the CAF.
10 Nov 20268 min read
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
3 posts found
Defender XDR Advanced Hunting Tables Cheat Sheet for MSP SOCs
The Defender XDR tables your analysts query most, the columns worth remembering, starter KQL and the multi tenant rules that keep MSP hunts fast and clean.
5 Nov 20267 min read
How to Hunt for Hidden Scheduled Tasks on Windows Servers
Find scheduled tasks hidden by deleting their SD registry value, as seen with Tarrask, using registry telemetry, Task Scheduler logs and a read only estate sweep.
23 Oct 20268 min read