Other Work

Blog posts and publications on other sites.

SANS

• 2026-02-25 SANS Webinar: Detection Engineering That Scales: Practical Strategies for Resilient, Maintainable Security Operations
• 2026-02-24 SANS Whitepaper: Rethinking Detection Engineering: A Practical, Threat-Informed Path Forward for Modern Security Teams

NVISO

• 2026-06-04 The Detection & Response Chronicles: Covert Operations Through QEMU
• 2026-01-29 ConsentFix (a.k.a. AuthCodeFix): Detecting OAuth2 Authorization Code Phishing
• 2025-12-16 The Detection & Response Chronicles: Exploring Telegram Abuse
• 2025-11-25 Detection Engineering: Practicing Detection-as-Code – Tuning – Part 8
• 2025-10-07 Detection Engineering: Practicing Detection-as-Code – Monitoring – Part 7
• 2025-09-23 Detection Engineering: Practicing Detection-as-Code – Deployment – Part 6
• 2025-09-09 Detection Engineering: Practicing Detection-as-Code – Versioning – Part 5
• 2025-08-26 Detection Engineering: Practicing Detection-as-Code – Documentation – Part 4
• 2025-08-05 Detection Engineering: Practicing Detection-as-Code – Validation – Part 3
• 2025-07-17 Detection Engineering: Practicing Detection-as-Code – Repository – Part 2
• 2025-07-08 Detection Engineering: Practicing Detection-as-Code – Introduction – Part 1
• 2025-01-16 Detecting Teams Chat Phishing Attacks (Black Basta)
• 2024-09-05 Validate your Windows Audit Policy Configuration with KQL