Blog

Field notes from the research loop — what we detonated and what the SIEM saw, findings the data surfaced, and the ones we killed under scrutiny. Each post is grounded in a corpus record or a lab run you can open.

Detection win

Nine Windows techniques went from "ran, nobody noticed" to detected, and one rule arm still missed

In our lab, nine Windows Atomic Red Team tests that earlier graded partial or failed were re-run against new or re-tagged Wazuh rules, and all nine graded detected. One of the fourteen new rules did not fire, and the reason is the useful part.

2026-11-02Discovery

Most of our Windows alert noise was our own test harness, and silencing it cut the baseline by about 80%

After we traced the 10,000-alerts-an-hour Windows baseline to one audit setting, the raw events showed the trigger was our own VMware Tools guest operations. Two rounds of level-0 rules took the lab baseline from 474-1,629 alerts per 30 minutes to 116-264.

2026-11-02Detection win

The obvious Linux credential-theft rule raised zero alerts. Here's why, and what fired instead

An auditd file-read watch on a credential file looks like the textbook detection, but Wazuh's bundled audit rules never alert on it. Rewriting both Linux unsecured-credential rules to key on execve records got them firing in 1 to 3 seconds.

2026-10-30Pattern

10,000 alerts an hour, and 87% of them came from one audit setting

Our Windows lab victim makes at least 10,000 Wazuh alerts an hour before we attack it, and one built-in rule for Security event 4673 produces 87% of them. Linux makes about 130.

2026-10-28Pattern

We tried to prevent ClickFix in the lab — and measured whether it actually worked

We turned the "delete the category" ClickFix prevention claim into a measured A/B in the lab. With the interpreter allowed the pasted command ran; with it denied, it didn't — and the denial was logged. Verdict, on the evidence: proven.

2026-10-28Detection win

We hijacked an RDP session in the lab. Here's exactly what fired.

A three-command RDP session hijack tripped two custom Wazuh rules in two seconds — and lit up a Sysmon trail any defender can hunt for.

2026-10-14Pattern

Delete the category — prevention that makes the mistake impossible

A defender blocked every ad network at their resolver and malvertising stopped being a thing a human could click. That move generalises into five prevention patterns — and here is which ones our lab can actually prove.

2026-10-14Negative result

Our miner found a slick cloud token-theft attack chain. We killed it.

A link-prediction miner surfaced a coherent cloud-identity kill chain with great-looking numbers. Under adversarial review it was technique near-duplication, not sequencing — so it never became a finding.

2026-10-13