Open in app
Sign inGet started
From soup to nuts: Building a Detection-as-Code pipeline

From soup to nuts: Building a Detection-as-Code pipeline

Part 2 of 2
Go to the profile of David French
David French
From soup to nuts: Building a Detection-as-Code pipeline

From soup to nuts: Building a Detection-as-Code pipeline

Part 1 of 2
Go to the profile of David French
David French
Threat hunting in Okta logs

Threat hunting in Okta logs

Threat hunting tips to help blue teams defend their Okta Single Sign-On (SSO) organization from attack.
Go to the profile of David French
David French
Testing your Okta visibility and detection with Dorothy and Elastic Security

Testing your Okta visibility and detection with Dorothy and Elastic Security

Dorothy has 25+ modules to simulate actions an attacker may take while operating in an Okta environment.
Go to the profile of David French
David French
Detecting Adversary Tradecraft with Image Load Event Logging and EQL

Detecting Adversary Tradecraft with Image Load Event Logging and EQL

While examining some malicious Microsoft Office and PE files to look for detection opportunities, I came across a few samples where…
Go to the profile of David French
David French
Detecting & Removing WMI Persistence

Detecting & Removing WMI Persistence

Windows Management Instrumentation (WMI) Event Subscription is a popular technique to establish persistence on an endpoint. I decided to…
Go to the profile of David French
David French
Detecting Attempts to Steal Passwords from Memory

Detecting Attempts to Steal Passwords from Memory

An adversary can harvest credentials from the Local Security Authority Subsystem Service (LSASS) process in memory once they have…
Go to the profile of David French
David French
About threatpunterLatest StoriesArchiveAbout MediumTermsPrivacyTeams